A little clarification on NameIDs

[Wessel, Keith]

Hi,

We're in the process of configuring our IDP to release a mail-formatted nameID to a vendor. We'd like to use the value of eduPersonPrincipalName instead of mail to do this, and I believe I see how to configure this in saml-nameid.xml.

According to the docs for custom NameID generation, it's necessary to also release the attribute to the SP in attribute-filter.xml. If I do this, does it mean I'll be sending eppn to the SP as both the nameID and an attribute in the assertion? I suppose this isn't a problem unless the vendor doesn't like that for some reason.

If I do need to release the value only as the nameID, is the best way to do that to define a second attribute in my attribute resolver config with the same definition but no encoders, or is there a cleaner way?

Keith