Need help understanding <SubjectConfirmation>

Hi Folks,

 

Would you help me to understand the purpose of the SubjectConfirmation
element? 

 

Here a subject is being identified by his email address:

 

    <Subject>

        <NameID
Format="urn:oasis:names:tc:1.1:nameid-format:emailAddress">

           


        </NameID>

    </Subject>

 

Why isn’t this sufficient to identity the subject? 

 

Here is an example that both (1) identifies a subject by his
email address, and (2) provides additional information about the subject using
SubjectConfirmation.

 

    <Subject>

        <NameID
Format="urn:oasis:names:tc:1.1:nameid-format:emailAddress">

           


        </NameID>

       
<SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:holder-of-key">

           
<SubjectConfirmationData
xsi:type="saml:KeyInfoConfirmationDataType">

               
<ds:KeyInfo>

           
        <ds:KeyName>John Doe's
Key</ds:KeyName>

               
</ds:KeyInfo>

           
</SubjectConfirmation>

       
</SubjectConfirmation>

    </Subject>

 

Here’s what the spec says:

 

“Subject confirmation takes place when a relying party
seeks to verify the relationship between an entity presenting the assertion
(that is, the attesting entity) and the subject of the assertion’s claims”

 

Suppose that I am a SAML authority and I send you an
assertion containing the above <Subject> element.  According to the
spec, the SubjectConfirmation will enable you to “verify the relationship
…” What relationship are you verifying?  Are you verifying that
I (the SAML authority) really do know about this fellow John Doe?  That
is, by me providing you some intimate knowledge about John Doe, I am demonstrating
that I really do know him.  Thus, you are able to “confirm”
that I really do know this fellow John Doe, and you should accept any assertion
that I make about him.  Is that what SubjectConfirmation is all about?

 

/Roger