help with SAML NameID putting different values when integrating more than 2 tenants for Workday

[Cantor, Scott]

On 3/4/15, 7:01 PM, "Alvarez, Dyana I" <d.alvarez2 at miami.edu> wrote:


>
>I guess my question is when I add a new tenant why does it add the series 
>of numbers to the SAML's nameID portion as shown above.

If you don't control which format is selected using the machinery the IdP 
supports to do that, then you have no control over it. QED. You cannot 
depend on the format you want being used unless you follow the appropriate 
steps to actually get the right one selected.

You also can't really control it properly when the "unspecified" format is 
used. That basically breaks all the mechanisms in place to control it. If 
you don't have to use that format, don't use it. Make up a URL and assign 
that as the format to use for the Workday app, and then you can put it 
into the metadata as a <NameIDFormat> and it will pick the right format.

Secondly, if you get one instead of the other, usually it's because 
there's a rule filtering out the attribute with the encoder attached that 
does what you're expecting, and so all that's left is the transientID to 
encode into the subject.

>We ruled out the fact that it could be encrypted because I have added.

A transient ID is not encrypted, not in the way you mean.

-- Scott