IDP-initiaded SSO or IdPUnsolicitedSSO

[Cantor, Scott]

On 10/16/13 12:42 PM, "Jehan Procaccia" <Jehan.Procaccia at it-sudparis.eu>
wrote:
>
>So if I understood well, that attribute name is "email" (not mail right
>!?)

There are many names here, internal ones you control and wire names for
the SAML attributes.

>it's nameFormat is either SAML1String or SAML2String
>and it's not a NameID .

Those aren't nameFormats, they're encoders for producing the XML
representation.

>If I want it to become a NameID it must be of type
>xsi:type="SAML2StringNameID" , but is it possible to sent multiple
>NameID attributes

You can encode as many as you want, only one will be included.

> my IDP already sends
>AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID"

That is not a NameID in the assertion, it's an internal value of a complex
nature that is managed as a NameID object. Different things.

>Does this mean that my initial shoot at Unsolicited/SSO :
>https://idp.int-evry.fr/idp/profile/SAML2/Unsolicited/SSO?....
>isn't used anymore ? the Unsolicited/SSO I created in handler.xml isn't
>necessary !?

Yes.

-- Scott