Multiple Attributes Released that can be encoded as NameID's in IdP v2.4.3

[IAM David Bantz]

> On Tue, Oct 27, 2015 at 12:08 AM, Peter Schober <
> peter.schober at univie.ac.at> wrote:
>
>> Either way, SAML Metadata and/or nameIDFormatPrecedence in the
>> appropriate relying party config are the answer for reliably
>> controlling the release of the right NameID.
>>
>

> Thanks for the hint; I have an analogous need.

> In my (I think typical) case, there are multiple attributes with the
"right" nameIDFormat or nameFormat.
how could force the selection of ID# ? Is it sufficient to have a
restrictive attribute release policy?

The documentation at
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier, in
particular the section "IdP Name Identifier Selection Process," does not
explicitly say the
candidate attributes have to be allowed to the SP by the release policies
in attribute-filter.xml, but I think
they must be, yes?

Thanks,
David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151027/c95a947c/attachment.html>