NameID Generation to SP

[Cantor, Scott]

>On 3/24/16, 7:56 PM, "users on behalf of Jay Mey" <users-bounces at shibboleth.net on behalf of jmey at vmware.com> wrote:
>
>>Currently, I have enabled persistent NameID Generator and it seems to be doing the encoding properly as seen below in the idp-process.log. The end result of the mail attribute is a string like "9UoJLXa4TmaVDLUSk+7nh+9xUa4=“
>> which is what is passed on to my SP as the username and email. The SP cannot read it in this format. Is this the correct result that should be expected?

To explicitly answer that question though, yes, that's exactly what you should expect. A persistent ID is an opaque value specific to one SP that you have configured the IdP to generate via a salted hash over a source attribute, email in this case.

If the SP cannot read it in that format, you've just established that it does not in fact support that format. And certainly not transient. What it really wants is "just give me an ID and stop forcing me to understand SAML", but if it wants an email address the emailAddress format is an appropriate choice to use.

Of course, email address is a poor identifier also, but that's orthogonal to any SAML issues.

-- Scott