Need help understanding <SubjectConfirmation>

["Costello, Roger L." <costello@mitre.org>]

Hi Folks,

 

Would you help me to understand the purpose of the SubjectConfirmation element?

 

Here a subject is being identified by his email address:

 

    <Subject>

        <NameID Format="urn:oasis:names:tc:1.1:nameid-format:emailAddress">

            j.doe@acompany.com

        </NameID>

    </Subject>

 

Why isn’t this sufficient to identity the subject? 

 

Here is an example that both (1) identifies a subject by his email address, and (2) provides additional information about the subject using SubjectConfirmation.

 

    <Subject>

        <NameID Format="urn:oasis:names:tc:1.1:nameid-format:emailAddress">

            j.doe@acompany.com

        </NameID>

        <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">

            <SubjectConfirmationData xsi:type="saml:KeyInfoConfirmationDataType">

                <ds:KeyInfo>

                    <ds:KeyName>John Doe's Key</ds:KeyName>

                </ds:KeyInfo>

            </SubjectConfirmation>

        </SubjectConfirmation>

    </Subject>

 

Here’s what the spec says:

 

“Subject confirmation takes place when a relying party seeks to verify the relationship between an entity presenting the assertion (that is, the attesting entity) and the subject of the assertion’s claims”

 

Suppose that I am a SAML authority and I send you an assertion containing the above <Subject> element.  According to the spec, the SubjectConfirmation will enable you to “verify the relationship …” What relationship are you verifying?  Are you verifying that I (the SAML authority) really do know about this fellow John Doe?  That is, by me providing you some intimate knowledge about John Doe, I am demonstrating that I really do know him.  Thus, you are able to “confirm” that I really do know this fellow John Doe, and you should accept any assertion that I make about him.  Is that what SubjectConfirmation is all about?

 

/Roger