relying party rule question

[Cantor, Scott]

On 4/25/17, 4:15 PM, "users on behalf of Mike Flynn" <users-bounces at shibboleth.net on behalf of shibbolethlynda at yahoo.com> wrote:

> I have a customer that is telling me this:
>
> you need to change the supplier initiated SAML request to use:
> <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />

If they want to send you that Format, which is dumb to begin with, they're more than capable of doing it themselves.

> I have about 2000 IDPs connected to me and I do not want to change anything to affect those folks.  Is it possible to set a relying
> party rule or something to give these folks what they are asking for?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRelyingPartySettings

As of 2.6 you can set NameIDFormat in one. But if you screw it up, you can break pretty much any IdP, so it's not something to mess with in production without testing it first.  NameIDPolicy has mandatory semantics in SAML, an IdP can't ignore it.

-- Scott