StoredID/persistentID only when used?

[Simon Lundström]

On Fri, 2016-09-09 at 13:47:00 +0000, Cantor, Scott wrote:
> On 9/9/16, 9:24 AM, "users on behalf of Simon Lundström" <users-bounces at shibboleth.net on behalf of simlu at su.se> wrote:
> 
> >    I want to create an activation condition which checks the SPs metadata
> >    if they have a NameIDFormat which has the value
> >    "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent".
> 
> Well, the point is you shouldn't need to do this to control anything related to NameID generation.

Is there another way?

What we're trying to accomplish is to avoid generation (and storing in
DB) and releasing (and thus fetching from DB) of the persistent ID.

Of the ~4000 SPs in our federation only ~10% of the SPs support
persistant nameid and only two SPs use it (that we know of).

So we would like to only generate, store, fetch and release it when it's
used; not always everytime to every SPs.

> Assuming that's not the use case, I don't know offhand what code would be usable to do that without pulling in other behaviors, other than a script of course. Probably running MetadataNameIdentifierFormatStrategy and applying .contains(...) to the resulting list.

Ah, which context should we use for this? (I haven't looked at the
source for this yet. My head is rather mushy after banging my head
against beans for the last day and a half.)

Have a great weekend!

BR,
- Simon