NameID from Subject

[Cantor, Scott]

On 8/5/14, 10:06 AM, "Andy Bennett" <andyjpb at knodium.com> wrote:
>
>Right... but how is it doing it? The NameID there in the log doesn't
>match the NameID I get anywhere else??

Then you're not looking at a NameID anywhere else.

>Right... so where is this NameID in the logs that is reversible coming
>from? ...and how do I get it in the web server variables as well?

>From a transient format NameID in the assertion probably. I described how
to map other NameID formats in the first response I sent in this thread,
by using the format constant as an attribute name in a mapping rule in
attribute-map.xml

The transient format constants are
urn:oasis:names:tc:SAML:2.0:nameid-format:transient and
urn:mace:shibboleth:1.0:nameIdentifier

I reiterate that a transient ID has no real purpose except for logout and
making attribute queries *at the time of SSO*. It is not meant to be used
afterward. There's nothing you can do with it that you should be doing
with it (other than perhaps your own logging or audit trail).

-- Scott