Shibboleth 2.5 NameID format element

[Peter Schober]

* Hotra, Jason M. <JASON.M.HOTRA at saic.com> [2012-09-19 19:18]:
> I have installed and configured the Shibboleth 2.5 SP and
> successfully authenticated to my required IdP on their
> pre-production environment.  We are now moving to their production
> environment and I have been asked why the NameID format element is
> not part of the SAML request.

A possible explanation by way of a short story: I recently had trouble
getting IdPs to work with an SP which requires a specific NameID
format (persistent), but not every IdP it needs to federate with is
guaranteed to support that -- some only support sending the exact same
data in an attribute (eduPersonTargetedId), as opposed to in the SAML
assertion's Subject element.

Now, as there can only be one such NameID in the Subject, sending
/any/ requirement for a NameID from the SP would fail certain IdPs:
Requiring persistent NameIDs all IdPs would fail which send it as an
attribute. And requiring transient NameIDs (since all IdPs I'm
concerned with here support that) would fail with any IdPs which /do/
support persistent NameIDs and hence will send it instead of the
transient NameID (based on the SP announcing support for persistent
NameIDs in SAML metadata).
The only way out for me was to make the SP stop sending any NameID
formats in the AuthN request.

To answer your question, if you still want to do that:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionInitiator
Child Elements
  <samlp:AuthnRequest>

-peter