[security-services] Request to Generalize Issuer - was XACML changerequest

Title: Request to Generalize Issuer - was XACML change request

In the last meeting I agreed to provide specific changes required to allow the Issuer to contain NameQualifier and Foprmat, just as subject does, in order to provide more flexible matching of Issuer names. I also sugggested, without looking at the schema that the changes could be made backward compatable by using a Choice. However, it turns out that Issuer is an XML attribute.

So it looks like the change required is to change the line:

  <attribute name="Issuer" type="string" use="required" />

to:

  <attribute name="Issuer" type="saml:NameIdentifierType" use="required" />

Since NameIdentifierType extends string and since NameQualifier and Format are use="optional" I think this is backward compatable, but I may be wrong.

In the core spec, the simplest change would be to change the sentence on line 383 from:

The name of the issuer is provided as a string.

to:

The name of the issuer is provided as a SAML NameIdentifier. The NameIdentifier is described in section 2.4.2.2.

Alternatively, the description of NameIdentifier could be moved forward in the document.

Hal