Apparent inconsistencies in the Shibboleth wiki concerning persistent NameIDs for federating a Shibboleth IDP with Microsoft Azure

[Peter Schober]

* Florian Lengyel <Florian.Lengyel at cuny.edu> [2016-03-31 18:49]:
> <!-- Microsoft requires a custom Persistent ID Generator that sends the AD GUID -->
>    <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>         p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
>         p:attributeSourceIds="#{ {'ImmutableID'} }">

I don't know what an ImmutableID is but persistent NameIDs (i.e., that
specific nameFormat referenced in p:format) are defined in SAML Core,
8.3.7, denoting an identifier "that is specific to an identity
provider and a service provider".  Meaning the value must be different
when the same subject accesses different SPs from the same IDP.

Unless 'ImmutableID' satisfies those criteria stuffing it into a
persistent NameID is not appropriate.
-peter