NameIDFormat in SP metadata

Peter Schober peter.schober at univie.ac.at
Fri Sep 21 06:11:17 EDT 2012


* Grady, Michael Allen <m-grady at illinois.edu> [2012-09-21 05:11]:
> If I add:
> 
>       <NameIDFormat>
>         urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
>       <NameIDFormat>
> 
> to an SP's metadata, what impact should that have vis-a-vis the
> NameIDFormat the Shib IdP would choose to send to that SP? And in
> what circumstances would it have that impact?

Since you didn't mention it: Did you check with "IdP Name Identifier
Selection Process"
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier
and configure a nameIDFormatPrecedence (as per
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty )?

Btw, I still have a rule in my attribute filter supressing
(DenyValueRule) the release of transientId for those RPs to which I
release persistent NameIDs. I guess with proper metadata I could get
rid of that,
-peter


More information about the users mailing list