Sending custom transient nameid

[Ryan Suarez]

Hi Todd,

Yes, I tried that and it didn't work.  It still sends the proper
transient nameid.

thanks,
Ryan

On Thu, 2018-05-03 at 19:34 +0000, Boyd, Todd M. wrote:
> The "dealing with conflicting requirements" section of this page
> might prove useful:
> 
> 
> https://wiki.shibboleth.net/confluence/display/IDP30/CustomNameIDGene
> rationConfiguration
> 
> 
> Though I'm not sure if it will accept the transient URN as a valid
> format to override. Worth a shot, anyhow.
> 
> 
> 
> -Todd
> 
> ________________________________
> From: users <users-bounces at shibboleth.net> on behalf of Ryan Suarez <
> ryan.suarez at sheridancollege.ca>
> Sent: Thursday, May 3, 2018 2:07:04 PM
> To: users at shibboleth.net
> Subject: Sending custom transient nameid
> 
> Greetings,
> 
> There is some SP that requires a urn:oasis:names:tc:SAML:2.0:nameid-
> format:transient nameid with the value of the subject's email
> address. Yes, I know this is wrong. I just need to evaluate all my
> options.
> 
> 1. They have included <saml2p:NameIDPolicy AllowCreate="true"
> Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/> in the
> SP request. Is it possible to send instead a
> urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress nameid in the
> IdP assertion? This link leads me to believe the answer is no (though
> I want to confirm):
> "If a <NameIDPolicy> element with Format is supplied, a suitable
> identifier MUST be generated or an error will be returned."
> https://wiki.shibboleth.net/confluence/display/IDP30/NameIDGeneration
> Configuration
> 
> 2. Is it possible to send a subjects email address as a transient
> nameid just for the given SP? What work is involved?
> 
> regards,
> Ryan