Multiple login attribute best practices

[Cantor, Scott]

On 3/10/14, 7:52 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:
>
>This caught my eye. Do you mean "any of the NameID Formats defined in the
>SAML standard" or literally "any NameID Format other than transient or
>persistent"?

Primarily the former, though obviously using custom formats is just
designed around local use cases, but that's no different than custom
attributes.

>Not critical but I'm curious. You may recall that about a year ago I
>asked about a case where a vendor (at least claims) they require the
>userID in the NameID, and neither transient nor persistent format were
>appropriate. We ultimate defined a custom NameID Format and use the
>NameID's value (and not an attribute) as the userID at the SP. I'm
>wondering if you're meaning to say this is bad practice.

I didn't mean bad, just "not best".

The particular issue I have is that all the other formats from SAML 1.1
days were underspecified and there was never any agreement on what they
meant, or what the use of NameQualifiers would mean. I took issue with the
fact that people argued that "email format" didn't mean "has this email
address". I find that incomprehensible, so I considered all the old
formats deprecated in 2.0.

-- Scott