No NameID released

[Peter Schober]

* David Bantz <dabantz at alaska.edu> [2014-08-12 02:25]:
> I was wrong about releasing transientId to any service - that’s
> commented out as historic and replaced with release transientId to
> InCommon members, and, alas, AWS is not an InCommon member.

You might also want to reconsider that change.

There's no harm done in releasing transientIDs to anyone, hence the
default policy rule (in fact the only thing the IDP is configured to
release by default).

And membership in a federation (probably referencing the 'Name' XML
attribute on an EntitiesDesriptor) may also not be the best choice to
base attribute release policies on today.

Also some SAML SPs will fall over with no NameID in the Subject, so
unless you want to make it your duty to make sure services always get
added at least transientID in a filter policy rule, why not revert to
the default behaviour and maybe add a NameID preference to your
relying-party.xml?  That would ensure that at least transient will be
there when no other NameID can be released.
-peter