release Name ID as an attribute

[Peter Schober]

* Qian, Yi <yqian at ku.edu> [2014-09-25 18:03]:
> The question is can Shibboleth IdP release NameID in the saml
> subject and attributes at the same time? My impression is I cannot
> do that after looked at the shib wiki.

If you've ever released eduPersonTargetedID you've released a SAML
NameID in a SAML attribute. Here's the proper structure:

<Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
  NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
  <AttributeValue>
    <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
     NameQualifier="https://idp.example.org/idp/shibboleth"
     SPNameQualifier="https://sp.example.org/shibboleth">gixGXvIbAnMFTumes5xV6ilHcg==</saml2:NameID>
  </AttributeValue>
</Attribute>

eduGAIN even recommends releasing that as both an attribute and also
in the assertion's Subject (to support implementations/applications
who only support checking one or the other), but I'm not too happy
about that. (Among other things because all Shib SPs will now see two
identical values, as Shib supports both and merges them into the same
structure, by default. Also saml2int says to put in the Subject, so we
already have profiling in place.).
-peter