Name ID in Subject and Name ID in AttributeValue

[Martin B. Smith]

Hi all,

I'm looking at the difference between sending a SAML2 Name Identifier (a 
persistent one) as part of the Subject in an assertion and/or as part of 
the AttributeStatement of an assertion.

I don't have a sense as to whether it makes sense to send in both 
subject and attributestatement, or whether one should suffice?

It seems like the Shibboleth service provider software is more likely to 
offer the persistent ID as an environment variable if I place it in an 
AttributeStatement. Though, it seems like simpleSAMLphp really wants to 
see the name identifier as part of an assertion's Subject.

Thanks in advance,
-- 
Martin B. Smith
smithmb at ufl.edu - (352) 273-1374
CNS/Open Systems Group
University of Florida

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4906 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20120725/d77e0a5d/attachment.bin