> On Jan 20, 2017, at 12:58 PM, Cantor, Scott <cantor.2 at osu.edu> wrote: > > The difference between "no NameID" and "transient NameID" is "logout is possible". It has no effect on SSO whatsoever unless the implementation is broken. OK, then there's no causality between our bogus NameIDFormat and the random login failures. Thanks. Tom.