mix different NameIDs for different SPs

[IAM David Bantz]

On 19Mar, 2021 at 10:27:17, Nate Klingenstein <ndk at signet.id> wrote:

>
> There should be no reason why you would need to base your persistentId
> generation on a particular attribute for a particular vendor.
>

Love the perspective, but multiple SPs make that demand of my IdP, so I
have a string of such clauses, basing NameID on email, ePPN, uid, employee
#, etc.
Sometimes they also specify a format for the NameID, even one that is
inconsistent with the normal form of the identifier they want! In a world
where 1:1 trust and configuration is the norm, SP vendors don’t see a
reason not to make up anything that occurs to them and make it a
“requirement" for “federation” with their app.

Evangelize multi-lateral federation!

David St. Pierre Bantz
U Alaska
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210319/bcfd24c5/attachment.htm>