Name ID in Subject and Name ID in AttributeValue

[Cantor, Scott]

On 7/25/12 3:24 PM, "Martin B. Smith" <smithmb at ufl.edu> wrote:
>
>I'm looking at the difference between sending a SAML2 Name Identifier (a
>persistent one) as part of the Subject in an assertion and/or as part of
>the AttributeStatement of an assertion.

Most implementations can't handle a complex attribute value like a NameID.
Using the subject is better for interoperability if the data can't be
represented without XML. That particular NameID Format has no defined
representation other than as a NameID element.

>I don't have a sense as to whether it makes sense to send in both
>subject and attributestatement, or whether one should suffice?

I suppose you can cover all your bases with both, but I don't know of
anything that would fail to handle the former but would handle the latter.
I'm sure something does.

-- Scott