urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

[Peter Schober]

* Joshua Brodie <josbrodie at gmail.com> [2020-09-08 20:48]:
> I had posted on this a while back and was unfortunately side-lined :(

Well, you asked about sending email address values with the
'persistent' NameID format and were shot down rightfully, as that's
invalid. Here's a quote from the spec, SAML core, p.86[1]:

> 8.3.7 Persistent Identifier
> URI:urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
>
> Indicates that the content of the element is a persistent opaque
> identifier for a principal that is specific to an identity provider
> and a service provider or affiliation of service
> providers. [E86]Persistent name identifiers generated by identity
> providers MUST be constructed using values that have no discernible
> correspondence with the subject's actual identity (for example,
> username). [...]
> The intent is to create a non-public, pair-wise pseudonym to prevent
> the discovery of the subject's identity or activities.

Email addresses violate that intent and those MUST requirements.

If you need to be sending email addresses as NameIDs then there's even
a matching NameID format defined in the spec, see 8.3.2, on p.85 of
that PDF.[1]

> However 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent' seems
> to be fixed to EPTI no matter what I do.

Could you explain what the above means, exactly?
The new-for-IDPv3 saml-nameid.* mechanism does *not* create any
eduPersonTargetedID (nor any other) *attributes*, you'd have to create
those yourself in the attribute-resolver.
So as written the above is nonsensical to me.

-peter

[1] https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf