Subject: [abfab] Issue 18 - Missing issue?

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Sat, 17 Dec 2011 18:37:03 +0200

Hi Jim, 

in issue #18 http://trac.tools.ietf.org/wg/abfab/trac/ticket/18 you
wrote:
"
Should the following issue be addressed as well?
In the presence of multiple federations, the naming of individuals can
become murky especially if one is trying to associate a single
individual from different federations. Asking a question such as does
John Doe belong to an IdP (in the absence of authentication) may get an
answer for the wrong John Doe.
"

In the way we define the architecture this is actually not an issue. All
entities are uniquely identified using a NAI and there is no mechanism
to query IdPs in the style of "Do you happen to know John Doe?"

What is an issue, which is outside the scope of our IETF work - I
believe, is the ability to associate user accounts from different
IdPs/federations. For example, I know known by one IdP as
hannes.tschofenig and another one as user12345 and maybe these two have
to be linked together. 

I would say that we don't worry about these issues since I don't see the
implications for our protocol work. I do, however, know that SAML tried
to solve some of these account linking use cases and others may have
more insight into how useful they had been.

Ciao
Hannes