Multiple login attribute best practices

[Eric Goodman]

> > This caught my eye. Do you mean "any of the NameID Formats defined in
> > the SAML standard" or literally "any NameID Format other than transient
> > or persistent"?
> 
> Sorry for jumping in...but surely the latter. For example, Google Apps
> for Education requires emailaddress as NameID, which most have
> criticized as bad practice.

I fail to see how responding is "jumping in". :) But that said...

I would also argue that's use of emailaddress is bad practice, but that's an example in the scope of my former example, not the latter one. That is, emailaddress *is* a NameID format defined in the SAML standard (urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress). 

In the use case I mentioned we used a custom NameID (not scoped to "urn:oasis:names:tc", but an OID from our own OID space). Such a NameID is obviously useless for interoperability outside of our organization, but that wasn't really a concern in this case.

Which -- come to think of it -- might have been Scott's point in the first place: that the defined ones are not good choices and custom ones aren't interoperable. When I read his comment, I read it as though he meant there might be a technical issue as well, but that may have been reading extra more into it than was there.  

--- Eric