NameID from Subject

[Andy Bennett]

Hi,

>> Right... but how is it doing it? The NameID there in the log doesn't
>> match the NameID I get anywhere else??
> 
> Then you're not looking at a NameID anywhere else.
> 
>> Right... so where is this NameID in the logs that is reversible coming
>> from? ...and how do I get it in the web server variables as well?
> 
>>From a transient format NameID in the assertion probably. I described how
> to map other NameID formats in the first response I sent in this thread,
> by using the format constant as an attribute name in a mapping rule in
> attribute-map.xml
> 
> The transient format constants are
> urn:oasis:names:tc:SAML:2.0:nameid-format:transient and
> urn:mace:shibboleth:1.0:nameIdentifier
> 
> I reiterate that a transient ID has no real purpose except for logout and
> making attribute queries *at the time of SSO*. It is not meant to be used
> afterward. There's nothing you can do with it that you should be doing
> with it (other than perhaps your own logging or audit trail).


OK. I think I'm beginning to understand.

I'm primarily looking to be able to go back later (weeks or months) and
ask whether the accounts are still existing at the IDP.

If I put <NameID> elements in my SP Metadata will I easily be able to
get more persistent NameIDs that I can use for this purpose or will it
generally require some changes on the IDP side? i.e. will an IDP with a
default configuration be expected to pass more persistent data?



I also note that one IDP that talks to us is always sending "staff" as
the NameIdentifier: field that appears in the logs. Is this going to
cause any problems?



Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/