saml-nameid.xml activation condition based on NameID format?

[Cantor, Scott]

On 9/11/20, 2:12 PM, "users on behalf of Mak, Steve" <users-bounces at shibboleth.net on behalf of makst at upenn.edu> wrote:

>    Our NameID outcomes require 2 things:
>    1. SP metadata must indicate preference for a NameID format OR relying party override must set NameID
> format preference.
>    2. The specific nameID that can fulfill such formats must be released (allowed) in our filter for that SP.

What I was trying to say, and not being clear on, was that #1 is really automatic. Unless the SP specifically triggers a non-default Format, you'll get the default (presumably transient), and it doesn't matter what the generators are. Essentially they all have an implicit activation condition that's based on those settings, it's just not implemented that way.

There is a third case in #1, of course, which is NameIDPolicy in an AuthnRequest, and that's always required to be honored because it's mandatory in SAML. But otherwise, one of the other two have to be applicable for #2 to matter.

-- Scott