Sending custom transient nameid

[Boyd, Todd M.]

The "dealing with conflicting requirements" section of this page might prove useful:


https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGenerationConfiguration


Though I'm not sure if it will accept the transient URN as a valid format to override. Worth a shot, anyhow.



-Todd

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Ryan Suarez <ryan.suarez at sheridancollege.ca>
Sent: Thursday, May 3, 2018 2:07:04 PM
To: users at shibboleth.net
Subject: Sending custom transient nameid

Greetings,

There is some SP that requires a urn:oasis:names:tc:SAML:2.0:nameid-format:transient nameid with the value of the subject's email address. Yes, I know this is wrong. I just need to evaluate all my options.

1. They have included <saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/> in the SP request. Is it possible to send instead a urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress nameid in the IdP assertion? This link leads me to believe the answer is no (though I want to confirm):
"If a <NameIDPolicy> element with Format is supplied, a suitable identifier MUST be generated or an error will be returned."
https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGenerationConfiguration

2. Is it possible to send a subjects email address as a transient nameid just for the given SP? What work is involved?

regards,
Ryan