Add Subject Identifier Test Cases

[waldofouche]

Given that the Shibboleth IdP will be running with this plugin: https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/4500914216/OPFederationWIP

It would be good to add a section of SAML/OpenID Federation interoperability. I have started with the a simple? ( maybe not ) case where a relying party is both registered to SAML and OpenID Federation. The end user should appear as the same user, regardless of auth mechanism.

cc @philsmart for additional thoughts

[philsmart]

Hi Waldo,

That is interesting. I hadn't thought of testing that kind of multi-protocol multi-federation approach. A few comments:

1. For those tests we would require compatible software (multi-protocol), and the flow tests are not specifically about testing all the capabilities of software products. But, if we go ahead, we could add a specific prerequisite for some of the tests.
2. We would need the service provider to support both protocols or run more than one software stack (SAML and OIDFed).
3. The SAML flow we would expect to work, and the basic OIDC Fed flow would be covered by other tests. So maybe this is specifically a test that we can generate identical/appropriate subject identifiers? If so, maybe it could be scoped like that in the tests i.e., the test is that the OP generates 'suitable/appropriate/saml-identical' subject identifiers (which could be a bigger topic and set of tests about identifier generation/type).

So yeah, I do see the value in having tests about subject identifier generation for OPs, but we might not need active dual federation stacks and topologies to support that, not sure. Probably overlaps with the policies WG as well.

[waldofouche]

Hi Phil,

Thanks for your thoughts. I agree that it would be better scoped to being able to generate `suitable/appropriate/saml-identical' subject identifiers. I've updated the docco c9eaf49

The main use-case I was considering was that since IdPs will support both protocols, it would be reasonable to ensure that SPs should compatible with the generated identifers from both stacks, so that when the time comes migrating from SAML -> OpenID Federation is simpler.

SP Implementation would vary wildly, but having the generation customizable from the OP side would be enough to satisfy this test case

[philsmart]

Having tests for identifiers seems like a good idea to me. The new test in your updated pull request looks great.