For testing with SimpleSAMLPHP, see https://simplesamlphp.org/docs/stable/simplesamlphp-reference-idp-hosted for reference on how to configure SSP
In a persistent identifier scenario, the RP requests a transient identifier using the transient scope, and should receive a pairwise sub per transaction, regardless of which persistent Identifier attributes we received from the SAML IdP as an identifier. We cannot deliver a persistent Identifier if we do not get any persistent Identifier from the SAML IdP
The following scenarios need to be tested:
| Configuration | Parameters (for SSP) | Expected Result |
|---|---|---|
Transient SAML NameID, eduPersonAffiliation and SchacHomeOrganization | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent urn:oid:1.3.6.1.4.1.25178.1.2.9 = example.org urn:oid:1.3.6.1.4.1.5923.1.1.1.1 = student | TRANSACTION MUST FAIL, as we have no persistent ID to base our response on. Redirect to invalid attributes page |
Transient SAML NameID, eduPersonScopedAffiliation | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org | TRANSACTION MUST FAIL, as we have no persistent ID to base our response on. Redirect to invalid attributes page |
Transient SAML NameID, eduPersonScopedAffiliation | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org | Student validation PASS RP receives a pairwise sub for each transaction. |
Transient SAML NameID, eduPersonPrincipleName, eduPersonScopedAffiliation | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient urn:oid:1.3.6.1.4.1.5923.1.1.1.6 = username@example.org urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org | Student validation PASS RP receives a pairwise sub for each transaction. |
Transient SAML NameID, eduPersonUniqueID, eduPersonScopedAffiliation | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient urn:oid:1.3.6.1.4.1.5923.1.1.1.13 = 3290vdsjk2njks9@example.org urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.org | Student validation PASS RP receives a pairwise sub for each transaction. |
Transient SAML NameID, eduPersonTargetedD, eduPersonScopedAffiliation | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:transient urn:oid:1.3.6.1.4.1.5923.1.1.1.10 = a6c2c4d4-08b9-4ca7-8ff9-43d83e6e1d35 urn:oid:1.3.6.1.4.1.5923.1.1.1.9 = student@example.orgFor config of ssp for generating ePTiD, see https://simplesamlphp.org/docs/1.5/simplesamlphp-authproc#section_2_5 | Student validation PASS RP receives a pairwise sub for each transaction. |
Persistent SAML NameID, eduPersonAffiliation and SchacHomeOrganization | ||
IdP: release
RP request:
| NameIDFormat = urn:oasis:names:tc:SAML:2.0:nameid-format:persistent urn:oid:1.3.6.1.4.1.25178.1.2.9 = example.org urn:oid:1.3.6.1.4.1.5923.1.1.1.1 = student | Student validation PASS RP receives a pairwise sub for each transaction. |