PersistentSAML2NameIDGenerator requires releasing attributeSourceIds

[Cantor, Scott]

On 4/9/15, 3:41 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>I'm attempting to release persistent SAML2 NameIDs on 3.1.1, and found that the source attribute has to be released to a relying party in order for PersistentSAML2NameIDGenerator to find an attribute value on which to perform the computation.

It's intentional (and should be documented that way).

>This feels like a bug, but I wanted to mention it here before filing an issue.

If I didn't do it that way, handling custom NameID formats that actually expose data would have either been accident-prone or I would have have had to somehow completely separate different NameID types and generate them in different places, which I definitely didn't want. Filtering happens immediately after resolution, and NameID generation is much later (if at all), so it doesn't get to operate on the unfiltered data.

-- Scott