Problem setting NameIdFormat for SP3

[Per-Ake Dahl Ejemark]

Thanx for the answer. I will add them myself.

The Idp that I'm forced to uses demands that this is set in the metadata. That's the answer to the question. They have more questionable settings than this but sadly there is nothing I can do to influence this ☹

/Per-Åke

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober
Sent: den 31 oktober 2018 15:07
To: users at shibboleth.net
Subject: Re: Problem setting NameIdFormat for SP3

> What I want is that the generated metadata has the NameIdFormat 
> elements at the end of the SPSSODescriptor.
[...]
>     </SPSSODescriptor>
> 
> I have tried to accomplish this by setting the <SSO> element in the 
> shibboleth2.xml like this
> 

The documentation only mentions that this influences the NameIDFormat that's sent in authn requests, so this probably doesn't extend into metadata generation.
Since this setting only allows a single format (AFAIU) it would also be unsuitable for use in SAML Metadata, as you'd likely want to publish several NameIDFormat elements in metadata as your own example shows.
So you'd probably have to add that to the metadata yourself.

Which brings us to the reason why you want this in the metadata generation handler.

Finally, note that persistent NameIDs might be on the way out, at least for deployments that care about saml2int.

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net