NameIDFormat in SP metadata
Peter Schober
peter.schober at univie.ac.at
Fri Sep 21 06:11:17 EDT 2012
* Grady, Michael Allen <m-grady at illinois.edu> [2012-09-21 05:11]:
> If I add:
>
> <NameIDFormat>
> urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
> <NameIDFormat>
>
> to an SP's metadata, what impact should that have vis-a-vis the
> NameIDFormat the Shib IdP would choose to send to that SP? And in
> what circumstances would it have that impact?
Since you didn't mention it: Did you check with "IdP Name Identifier
Selection Process"
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
and configure a nameIDFormatPrecedence (as per
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty )?
Btw, I still have a rule in my attribute filter supressing
(DenyValueRule) the release of transientId for those RPs to which I
release persistent NameIDs. I guess with proper metadata I could get
rid of that,
-peter
More information about the users
mailing list