Help with IdP attribute configuration

[Peter Schober]

* mariasol <sol.garcia at globant.com> [2014-07-21 19:48]:
> It's working now.

Great!

> Should I delete transientId  from the attribute resolver?

No. The software will use it when no other NameID has taken precedence
(if configured as below) and some SPs expect a (i.e., any) NameID to
be there.

> I saw in the documentation that the IdP select the attibute from the set of
> possible attributes
> (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier), do
> you know how can I know if the service provider requires a particular
> format?

Most everything the IDP knows about an SP is from its SAML metadata
(cf. NameIDFormat).

> Or should I configure the nameIDFormatPrecedence on the
> RelyingParty?

Sure, that's the best option, esp. if you don't manage/control the SPs
metadata yourself, e.g. when you get its metadata from a federation
(trusted 3rd party).
Outliers can still be handled with a DenyValueRule in the
attribute-filter.xml, if needed.
-peter