question on namespace definitions from ancestor element

["Kyle Meadors" <kyle@drummondgroup.com>]

A question from the SAML IOP test event has arisen. Any guidance would be appreciated.

 

Must an Assertion element be constructed so that it can be validated as a standalone element, outside of the enclosing Response element, with respect to its namespace definition? Or, should the SP be able to obtain the namespace definition from the Response ancestor if the prefix is defined in PrefixList attribute of the InclusiveNamespaces element. One of the parties involved cited section 5.4.3 of SAML Core that the assertion should be validated independent of the Response.

 

Below is the Response in question. Key part is the prefix “xmlns:xs="http://www.w3.org/2001/XMLSchema” defined in the Response element and used later in an Attribute found in the Assertion.

 

 

<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xs="http://www.w3.org/2001/XMLSchema" …// Cut out rest of the attributes>

 

<saml:Assertion ID="Assertion-uuid7ebdc94e-0122-112e-8a00-a4a0d87c9b31" IssueInstant="2009-07-15T14:08:02Z" Version="2.0">

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="uuid7ebdc964-0122-1d1f-8bcd-a4a0d87c9b31"><ds:SignedInfo>

 

<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></ds:CanonicalizationMethod><ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod><ds:Reference URI="#Assertion-uuid7ebdc94e-0122-112e-8a00-a4a0d87c9b31">

 

<ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Transform><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><xc14n:InclusiveNamespaces xmlns:xc14n="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xsi xs saml"></xc14n:InclusiveNamespaces></ds:Transform></ds:Transforms>

 

...// Rest of the Signature element

...// More parts of the Assertion

 

<saml:AttributeStatement>

<saml:Attribute Name="us:gov:e-authentication:basic:assuranceLevel" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">

<saml:AttributeValue xsi:type="xs:string">test</saml:AttributeValue></saml:Attribute>

</saml:AttributeStatement>

</saml:Assertion></samlp:Response>

 

Kyle Meadors

Drummond Group Inc.

Principal, Test Process

817-709-1627

kyle@drummondgroup.com

 

Calendar: http://tinyurl.com/KyleMeadors-DGI-Calendar

 

* * * * * * * * * * * * * * * * * * * * * * * *

CONFIDENTIALITY DISCLAIMER

This email, including attachments, is confidential and proprietary. It constitutes exclusive communication solely to the addressee. Any entity other than the intended addressee is prohibited from use of this communication for any purpose. This email, including attachments, may not be distributed, whole or in part.

* * * * * * * * * * * * * * * * * * * * * * * *