Allowed values for NameIDFormat

[Cantor, Scott]

> I'm working on setting up authentication with a vended product that
> minimally supports SAML2 (Service Now). They only
> look at the NameID, not any Attributes.

I did not believe that to still be true, but I am indeed using NameID with it for historical reasons so I can't prove it.

> Is it better to use the urn:oasis:names:tc:SAML:1.1:nameid-
> format:unspecified NameIDFormat

Nobody should use that format for any reason. It should never have been created.

> and a Relying Party override
> to force generating the NameID from ePPN, or can/should I setup a NameID
> generator for urn:oid:1.3.6.1.4.1.5923.1.1.1.6
> (ePPN's OID URN) and drive the selection from a NameIDFormat element in
> the SP's metadata?

How you accomplish the format selection is a style/config-mgmt decision, use whichever of the two mechanisms you prefer to ensure you understand what it's doing and don't lose sight of it.

Using the attribute name as the format is an appropriate choice when possible.

-- Scott