A little clarification on NameIDs

[Cantor, Scott]

> We're in the process of configuring our IDP to release a mail-formatted
> nameID to a vendor. We'd like to use the value of eduPersonPrincipalName
> instead of mail to do this, and I believe I see how to configure this in saml-
> nameid.xml.

Certainly could, yes.

> According to the docs for custom NameID generation, it's necessary to also
> release the attribute to the SP in attribute-filter.xml.

Not anymore, no. You would just set the p:useUnfilteredAttributes property on the generator. But it does default to filtered since it's a privacy exposure for most custom NameIDs.

We defaulted the persistent generators back to use unfiltered since that's just a seed and doesn't expose the seed data.

> If I do this, does it mean
> I'll be sending eppn to the SP as both the nameID and an attribute in the
> assertion? I suppose this isn't a problem unless the vendor doesn't like that
> for some reason.

It would, yes, if you released it.

> If I do need to release the value only as the nameID, is the best way to do
> that to define a second attribute in my attribute resolver config with the
> same definition but no encoders, or is there a cleaner way?

Cleaner now, that was the old workaround.

-- Scott