Changing NameID from transient to persistent

[Peter Schober]

* Vignesh, Vanna G. <vignesh at musc.edu> [2014-01-29 16:50]:
> Our IDP has NameID as transient but one of the SPs needs that to be a persistent value.
> 
> a)      If I change that to be persistent, would it cause any other problem?

You don't change the existing machinery that produces transientId to
state persistent. That's lying, and might also break all kinds of
things for subjects using that IDP with these SPs.

> b)      Inaddtion to attribute-filter.xml, would I have to change anything else?

The filter is the last thing you do after implementing persistentIds.

As to how to implement those and what to consider, look at the
documentation for NameIDs, that's why it was written.

> c)       Will any of the existing SP's get affected?

Depends on what exactly you do. If you make sure the change only
affects the SPs you intend do, no. If you don't, it could. E.g. an SP
could be prepared to make use of a persistentId if one were part of
the SAML and use that as preferred identifier for a subject. Since up
to now you didn't send one, the SP picked another attribte to
recognize subjects over time. If you sent persistent NameIDs to such
an SP it might end up chosing a different identifier for any subjects
from your IDP. That will either result in new accounts at the SP being
created (i.e., lost access to state on the SP linked to the old
identifier) or evel access denied in those cases where access is given
based on the identity of the subject, not an entitlement or
affiliation value.

So it all depends.
-peter