nameID content vs format

Cantor, Scott cantor.2 at osu.edu
Wed Aug 16 02:51:59 UTC 2023


The IdP would never produce a transient Format that was anything but transient unless it was misconfigured, and that is definitely a MUST NOT.

If you want to pass them an email address, you would use that Format.

If you want to pass them eduPersonUniqueID, that's typically an Attribute, and the convention for expressing any Attribute as a NameID (assuming it's sensible to do so) is that the Format is set to the Attribute's Name. I do it all the time, mostly with employeeNumber and one or two locally-defined ones.

-- Scott




More information about the users mailing list