Default NameIDFormat Metadata Elements

Klingenstein, Nate nklingenstein at calstate.edu
Wed Sep 14 14:25:35 EDT 2016


IdPv3 on install appears to generate metadata like:

    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
...
        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
    </IDPSSODescriptor>

and

    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
...
    </AttributeAuthorityDescriptor>

Attempts to kill the back channel aside, should these be the same?

I don't think there's much practical impact since SP's largely query based on received name identifiers and they probably all default to anything is okay, but I got questions about it.


More information about the users mailing list