Multiple Attributes Released that can be encoded as NameID's in IdP v2.4.3

[Alex Olson]

Hi there!

In the case where multiple attributes are being released that support NameID encoding, which one will end up being encoded as a nameID if there is no format precedence?

I know the docs say “at random” but is there any more information as far as how that will actually work?

If I have an AFP that looks like this:

    <afp:AttributeFilterPolicy id="releaseAttributesToEduCause">

        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
                                       value="https://www.educause.edu/shibboleth-sp" />

        <afp:AttributeRule attributeID="mail">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="givenName">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="sn">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="eduPersonPrincipalName">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>


And both “mail” and “eduPersonPrincipalName” can be encoded as NameID’s, which one will end up being the NameID? Will it consistently be one or the other or will it be truly random?

Thanks!

-- Alex
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151027/fe2aef42/attachment.html>