computedID in idpv3

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2016-02-15 15:43]:
> Yes, because that attribute is deprecated. The only implementation
> that seems to be broken in this regard is SSP. Mostly SPs can't
> handle a NameID-valued attribute anyway.

To be clear: SimpleSAMLphp does expose an API to get at the value of
the NameID in the Assertion's Subject element (incl configurable
munging of the 3-tuple, IIRC), it's just a different call than the one
that'll get you all available attributes and their values.

So (1) it's less elegant than with the Shib SP that doesn't care
either way (Attribute or Subject) unless you sabotage that
configuration yourself, and (2) it doesn't currently have a functional
equivalent to the Shib SP's REMOTE_USER abstraction (precedence list)
that would /also/ include the NameID from the Subject (only works for
attributes).

Together a + b are strong indicators (or so I would claim) that most
existing SSP deployments will not be prepared to handle IDPs' change
from Attribute to Subject without (small) code/config changes.
That's certainly not ideal but it's also a far cry from calling the
implementation broken.
-peter