Forcing Misuse of TransientID in IdP 3.2.

[Cantor, Scott]

> Is it possible to configure the SAML2TransientGenerator to send an attribute
> sourced value (similar to a persistent ID or other non-transient NameID)?  If
> so, is there documentation on how this might be done?

I would never document it, but there's nothing special about the format, it just uses the generators in order until one works. Put yours first, with an appropriate activationCondition on it, and it should be fine.

> I’ve informed the application owner that this misuse of the NameID format
> will need to be changed, but it’s rather unlikely they’ll be able to get the
> vendor to modify their code before we need to put IdP 3.3 into production.

Do you have actual proof that it matters? I'd be very dubious of anything that broken even looking at the Format.

> I’ve tried adding the below bean to the SAML2NameIDGenerators list in the
> conf/saml-nameid.xml configuration.

That works fine, but the ref to the default generator above it will be used first.

-- Scott