A little clarification on NameIDs

[Wessel, Keith]

Ah, yes! I did see that option in the docs for the case of multiple "unspecified" or other formats with different values. Shoulda thought of using that for this case, too. That definitely seems the cleanest/most secure.

Thanks,
Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, February 12, 2016 5:07 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: A little clarification on NameIDs

> Thanks, Scott. So, if I don't mind anyone requesting the mail nameid in their
> metadata to get it without explicit filter configuration, I can set the saml-
> nameid configuration to unfiltered. If I'm not confortable with that but the
> vendor can't also handle an attribute value coming through in the assertion,
> I'm back to the old fallback of the second attribute definition that doesn't
> include the encoders.
> 
> Is that correct?

You can also add an activation condition based on RP ID to the NameID generator.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net