SAML2StringNameID format

[Cantor, Scott]

On 6/9/14, 3:34 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>Remember that NameID is a Highlander-class attribute (there can be only
>one), so be sure to set up your attribute filter for this SP
>appropriately (typically by adding a deny all values rule for
>transientId if you're using the default release-to-everyone filter for
>it).

I don't advise that at this point, all you need to do is one of:

- add a <NameIDFormat> of the appropriate value to the SP's metadata
- or if you don't control or don't want to modify the metadata, add a
nameIDFormatPrecedence attribute to a RelyingParty definition for the SP

It's very common that an SP so limited as to require a NameID is also
requiring other non-default behavior requiring some kind of RelyingParty
definition. But if not, and you want to avoid the RP definition, and can't
use the metadata, then you'd have no recourse to control the format
emitted but to block every other possibility in the filter.

It's much easier to see what you're releasing and why with positive policy
than with negative.

-- Scott