nameID content vs format

[IAM David Bantz]

Today’s SP integration was for a commercial service portal that requires a
persistent nameID to identify the user account in their system, but doesn’t
care or states in doesn’t care about nameID format (“unspecified” in their
metadata). I’m using the old persistent eduPersonUniqueId, which results in
a somewhat odd-looking (to me) SAML assertion that has a Subject with a
“transient” nameID format but looks syntactically like an email address. My
question is whether that combination is:

   - merely aesthetically jarring but otherwise unobjectionable, or
   - a kind of impoliteness that should be remedied with a relying party
   override to prefer another nameID format (like email?), or
   - a violation of some standard or good practice that “must” be remedies
   [“must” in quotes, because the ugly is apparently consumed OK by the SP]


David St Pierre Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230816/f126cfb4/attachment.htm>