nameID content vs format
Cantor, Scott
cantor.2 at osu.edu
Wed Aug 16 02:51:59 UTC 2023
The IdP would never produce a transient Format that was anything but transient unless it was misconfigured, and that is definitely a MUST NOT.
If you want to pass them an email address, you would use that Format.
If you want to pass them eduPersonUniqueID, that's typically an Attribute, and the convention for expressing any Attribute as a NameID (assuming it's sensible to do so) is that the Format is set to the Attribute's Name. I do it all the time, mostly with employeeNumber and one or two locally-defined ones.
-- Scott
More information about the users
mailing list