The SAML XML.org web site is not longer accepting new posts. Information on this page is preserved for legacy purposes only. For current information on SAML, please see the OASIS Security Services Technical Committee Wiki.
SecurityDomain attribute on NameIdentifier tag in SAML 1.1
Hi All,
Looking through SAML 1.1 samples in the Internet I found that many of them use SecurityDomain attribute on NameIdentifier tag to specify URL of security domain. But this attribute is missing in SAML 1.1 XSD (probably I cannot find it ?).
...
<saml:Subject>
<saml:NameIdentifier Name="ED.TIM" SecurityDomain="nchelp.org/meteor" />
</saml:Subject>
What is the origin of this attribute ? Is it valid to use it to specify security domain or it is implementation specific ? Thanks in advance.
Sergey Ponomarev.
Search
SUBSCRIBE
RECENT CONTENT
- SAML Wiki Knowledgebase
10 years ago - SAML 2.0 with java Sample
10 years ago - Govt Computer News: 'The power of one password'
10 years ago
1 reply - OASIS approves SAML 2.0 Errata
10 years ago
1 reply - IBM Pushes Federated Identity Management
10 years ago
1 reply - VMware Unveils Horizon App Manager
10 years ago
1 reply
SecurityDomain attribute on NameIdentifier tag in SAML 1.1
It's illegal, and I have no idea where people got it. The NameIdentifier element isn't attribute extensible, nor is the new one in SAML 2.0.
The NameQualifier attribute is more or less the same idea, but in general that attribute is under-specified in SAML 1.1, and its use is discouraged for the Formats defined there. For new Formats, it's reasonable to profile the attribute to be something interoperable, but as it stands now, it's mostly harmful.