Define a relying party profile for AuthnRequestsSigned="true"

[Cantor, Scott]

> Well, this
> p:attributeSourceIds="#{ {'uid', 'UDC_IDENTIFIER'} }"
> 
> was my attempt to get their preferred attribute name (UDC_IDENTIFIER)
> encoded as a NameID. I guess I made this syntax up, though... O_o

The syntax is fine/legal. But you're telling it to populate the NameID with the uid IdPAttribute first, and if that's missing, then the UDC_IDENTIFIER IdPAttribute. I don't know if that's what you want or not.

> I did try to humor their unspecified with this bit of configuration:

That's correct.

> It's not abundantly clear if they would just accept an attribute as the login id
> (rather than a NameID proper) - which would be nice. But I'm sending that
> out too, so...ugh. Dealing with SCT Banner/Ellucian/whoever isn't the easiest.

Most can't handle attributes, but ultimately that's case by case. I had one just the other day that does handle them but choked when I gave it a URI as an attribute name and wanted just a string. Every one-off implementation is broken, all in their own special way.
 
-- Scott