SAManage with Shibboleth 3?

[Cantor, Scott]

> Maybe but from a purely philosophical point of view they (the vendor)
> supply metadata to you (the IdP) in order to integrate with your SP. If you
> have to modify this in any way this means that you're acknowledging that
> their setup is broken!

Saying it's broken isn't quite accurate. Without a universally agreed upon identifier in a fixed form, there can never be a way to express the data requirements of a service in metadata since it's not applicable to all IdPs. If anything, it's only broken if they actually included a NameIDFormat or RequestedAttribute elements that in fact wouldn't be applicable globally.

All the vendors would be perfectly content if we got on board the rest of the world's train and made email address universally available and just ignored all its problems like the rest of the world has chosen to do.
 
The NameIDFormat trick is just a convenience to signaling the IdP what to do and it inevitable applies only to local metadata pretty much by definition.

-- Scott