NameID

[Cantor, Scott]

> Notwithstanding Scott’s reply, I have often run into this with vendor apps
> requiring that the NameID field be populated with a specific user attribute in a
> specific format. Here is how I have handled this.  For the examples I will use
> uid.

That isn't his particular challenge. The problem is format selection. If the vendor demands Format X in the request, the IdP has no choice but to respond that way or fail. The only way to do what the vendor is demanding in this case is to bastardize the system by adding a conditional generator that will produce a transient ID with a non-transient value and stick that ahead of the default transient generator in the chain.

As a member, if Cornell really wants to do that, I'm happy to give them the example, but my strong advice is to say no.

-- Scott