various nameid formats

[Peter Schober]

* Ramaiah, Vanna G. <ramaiah at musc.edu> [2017-03-22 18:35]:
> So, for an SP that is requesting uid in nameID , should something like this help if I am using legacy attribute-resolver file?
> 
> <resolver:AttributeDefinition id="uidNameId"  xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="sAMAccountName"> 
>   <resolver:Dependency ref="myAD" />
> 
>           <resolver:AttributeEncoder xsi:type="SAML2StringNameID"          xmlns="urn:mace:shibboleth:2.0:attribute:encoder"   nameFormat="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" />
>     </resolver:AttributeDefinition>

Well, as per RFC 4519 (via 2798, via 1274) uid would be
"urn:oid:0.9.2342.19200300.100.1.1". The URI you have above would be
for eduPersonPrincipalName which has more specific requirements, both
syntactically and semantically (not that the SP will care in this
case.)
So I wouldn't claim a sAMAccountName to be an ePPN on the wire.
I'd either use the URI for sAMAccountName as defined by M$, or the
proper URI for uid as suggested above.
-peter