targeted-id question

[Cantor, Scott]

> I do not think I have safeHeaderNames turned on as persistent-id passes as
> http_persistent-id like this:

Those are internal names directly from the attribute map, not the header names used on export.

I don't know what API you use or anything about its requirements. The information I have is in the https://wiki.shibboleth.net/confluence/display/SHIB2/secadv_20090615 wiki topic on what's safe and what isn't. But safeHeaderNames is in all the configs by default, unless it's an older one that predates the option.

-- Scott