Change the ID in the Saml response
Peter Schober
peter.schober at univie.ac.at
Fri Mar 3 16:46:08 EST 2017
* Klingenstein, Nate <nklingenstein at calstate.edu> [2017-03-03 19:55]:
> The question would need to be reformulated, though. The SAML Response
> ID should not be tampered with. They want you to send email as a name
> identifier with type persistent(which also shouldn't be done, but it
> sounds like that ship's out to sea).
There's always the method of sending email with the appropriate NameID
format and seeing whether the SP even notices.
The usual advise for replies such requests (i.e., to send stuff that's
in outright violation of the SAML specification) should remain "Just
Say No", though, and each IDP that bows to such requests is doing
everyone else here a disservice.
-peter
More information about the users
mailing list