Sending custom transient nameid

[Ryan Suarez]

Greetings,

There is some SP that requires a urn:oasis:names:tc:SAML:2.0:nameid-format:transient nameid with the value of the subject's email address. Yes, I know this is wrong. I just need to evaluate all my options.

1. They have included <saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/> in the SP request. Is it possible to send instead a urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress nameid in the IdP assertion? This link leads me to believe the answer is no (though I want to confirm):
"If a <NameIDPolicy> element with Format is supplied, a suitable identifier MUST be generated or an error will be returned."
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration

2. Is it possible to send a subjects email address as a transient nameid just for the given SP? What work is involved?

regards,
Ryan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180503/afcccf89/attachment.html>