problems seemingly caused by transientID in O365

[Cantor, Scott]

On 8/27/14, 11:13 AM, "Rob Gorrell" <rwgorrel at uncg.edu> wrote:

>So you are talking about something like:
> 
>nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persiste
>nt"
>
>But what if I have two nameid's encoded as persistent (like ImmutableID
>and eduPersonTargetedID") and my filter releases them both, which one
>wins? Or is that something i must control with the filter, making sure
>i'm not releasing two nameid's of same encoded format?

Yes, that would be a filter issue. That's a very unusual case, and I would
have to conclude that at least one of them is probably not really a SAML
persistent NameID, since such an identifier is purely opaque and the SP
can't be allowed to care what's in it. So if it does, that's not the right
format and the SP is broken.

-- Scott