NameID Format

[Cantor, Scott]

On 9/30/15, 4:26 PM, "users on behalf of Michael Dahlberg" <users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:

>Yes, my apologies.  Of course, I am releasing that attribute in the attribute-filter.xml file:

I know, but that's got nothing to do with format selection. There are historical reasons why people conflate them, but they haven't been related in many, many years and there is nothing I mentioned to that does so. All you have to do is release the attribute involved, the rest is about format selection.

>I appreciate the description of a persistent identifier but I don't know how it is used, what it releases, or where it releases it in the SAML payload.  I usually stop reading that particular page at that point.  I agree, I should continue on.
> 

The specific documentation section I pointed to doesn't say anything about any particular formats (aside from calling out the issue with "unspecified"), certainly not that one.

>I'm not sure how I would know that there "is not an e-mailAddress nameFormat unique to SAML 2.0" and what effect changing that nameFormat has on what is released, how it is released and where it is released..

If you want a book on SAML, that's not within my willingness to produce, not and still have a life. But the core standard is not that long  and the section on NameID Formats is near the end and is very short. That's all that's defined. Email address happens to be one of the predefined formats.

>Given that I am releasing the cnIdentifiedName in the attribute-filter, that other attributes can be released without blocking the transientID, would there be any other reason why the transientID is released and not the cnIdentifiedName?

You can hack things into submission by blocking the release of transientId as an attribute for just that SP so that the total set of candidate NameIDs is down to one, the one you want. The *right* way is documented in what I sent, you either put the Format you want into the SP's metadata, or if that's not practical you put it into a RelyingParty override via nameIDFormatPrecedence.

-- Scott