[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [security-services] question on MNI request for SP Lite/IdP Lite
Kyle Meadors wrote on 2009-03-25: > For this year's Liberty SAML IOP event, we are adding a new error test case > for SP Lite and IdP Lite applications. Per the SAML conformance > specification, SP Lite and IdP Lite MUST NOT support Name ID management > messaging and functionality. As some of the vendor products allow their > applications to be switched from SP to SP Lite mode (same with IdP and IdP > Lite), we need to fully test this "switch" and verify they are properly > acting in the SP Lite/IdP Lite mode. Is this really useful? Does anybody remember why we said MUST NOT and what that could possibly even mean? > 1. When a SP Lite/IdP Lite receives a MNIRequest, what should be their > proper response? Ignore the request? Generate an error <Status> response? > Either is acceptable? It shouldn't even have an endpoint to which you could send one, so it should never come up. > 2. After generating the MNIRequest, I planned on verifying the SP Lite/IdP > Lite did not accept the name ID change by sending a LogoutRequest using the > new name ID from the MNIRequest message and looking for the error <Status> > response that the SP Lite/IdP Lite does not recognize the principal. Then, > send the LogoutRequest using the original name ID from the Response message > and verifying principal is successfully logged out. Does this sound like a > reasonable test scenario? I think this is kind of a weird thing to require, let alone try to test. What I guess you'd want to do is simply verify that if something claims to support MNI but then returns an error when you try it, that the logout doesn't work. But something that doesn't support MNI simply has no place to send the message to. -- Scott
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]