SimpleSAMLphp and NameIDFormat in IdP metadata question from Dev call this morning

[Michael A Grady]

I want to confirm that SimpleSAMLphp works fine with IdP metadata that does not include a NameIDFormat element. In fact, as far as I can tell, it ignores them if they are present. (I thought I recalled a case where it actually took note of them if they were there, but I must be wrong about that.)

When I look at how you'd define a "remote IdP" for your SimpleSAMLphp-based SP, there isn't even an option for specifying a NameIDPolicy/NameIDFormat when you use the "PHP form" of configuring the metadata. You can configure the NameIDPolicy for a SimpleSAMLphp-based IdP, and it will be put into the metadata produced for that IdP, but not for remote IdPs that are defined for a SimpleSAMLphp-based SP.

p.s. SimpleSAMLphp has a "metadata convertor", where you can give it SAMLv2 metadata and it convert it to its corresponding "native PHP-form of metadata config". Any NameIDFormat elements in the SAMLv2 metadata for an IdP just get "ignored/tossed out".So it doesn't only not require them, it ignores them.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/dev/attachments/20161104/8964ac27/attachment.sig>