NameIDFormat in SP metadata

[Grady, Michael Allen]

On Sep 21, 2012, at 9:10 AM, Cantor, Scott wrote:

> On 9/21/12 7:39 AM, "Tom Scavo" <trscavo at gmail.com> wrote:
> 
>> On Thu, Sep 20, 2012 at 11:11 PM, Grady, Michael Allen
>> <m-grady at illinois.edu> wrote:
>>> 
>>>      <NameIDFormat>
>>>        urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
>>>      <NameIDFormat>
>> 
>> This entry in metadata has dubious semantics. The unspecified format
>> is not something the SP explicitly asks for or supports, but rather
>> something the IdP asserts in the absence of anything else.
> 
> I'd have to look at the code, but yes, my guess is that isn't treated like

Then it might be useful to consider changing the "advice" in the wiki page:

  https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCustomNameIdentifier

which highlights the following:

"The nameFormat choice is essentially arbitrary. SAML defines a few poorly specified options for some common syntaxes like email addresses or distinguished names, but in many cases the best choice is to use the "unspecified" option as above, or invent one you control."

>From these comments, it sounds like "unspecified" is NOT actually a good choice.


                      
--
Michael A. Grady                      
University of Illinois at Urbana-Champaign (retired)
217-721-3890