A little clarification on NameIDs

[Cantor, Scott]

On 2/12/16, 11:13 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>Ah, yes! I did see that option in the docs for the case of multiple "unspecified" or other formats with different values. Shoulda thought of using that for this case, too. That definitely seems the cleanest/most secure.

Well, the intention was that you have to trust metadata, so the idea that you would worry about somebody improperly including a NameIDFormat wasn't in my mind. InCommon itself doesn't support that element, though I suppose it's likely that eduGAIN's feed does. But it all comes back to trust. The system really doesn't function if you don't trust the metadata.

-- Scott