nameID content vs format

[Peter Schober]

* IAM David Bantz via users <users at shibboleth.net> [2023-08-16 04:40]:
> Today’s SP integration was for a commercial service portal that
> requires a persistent nameID to identify the user account in their
> system, but doesn’t care or states in doesn’t care about nameID
> format (“unspecified” in their metadata).

Arguably "persistent" *is* the NameID format then.  Unless, of course,
they mean something completely different than what the SAML spec
defines as "persistent" (see below), which, although likely, doesn't
really help when doing SAML.

> I’m using the old persistent eduPersonUniqueId, which results in
> a somewhat odd-looking (to me) SAML assertion that has a Subject with a
> “transient” nameID format but looks syntactically like an email address. My
> question is whether that combination is:
> 
>    - merely aesthetically jarring but otherwise unobjectionable, or
>    - a kind of impoliteness that should be remedied with a relying party
>    override to prefer another nameID format (like email?), or
>    - a violation of some standard or good practice that “must” be remedies
>    [“must” in quotes, because the ugly is apparently consumed OK by the SP]

Just have a look yourself, if not for this time then for the next one:
https://wiki.oasis-open.org/security -> Merged Versions -> Core w/ Errata ->
https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf
Section 8.3 Name Identifier Format Identifiers (p. 86 in the PDF)
"Persistent" is defined in 8.3.7, "Transient" in 8.3.8.

A Transient NameID has "an opaque and temporary value" which ePUID or
email addresses clearly do not satisfy. But not only is this wrong,
it's also a bit silly when you say the SP doesn't care about the
format -- why pick a format that's the furthest from being correct:
The SP wants something "persistent" and you put it into a "transient"
NameID? Makes no sense (despite violating the spec).

I've also used the approach Scott mentioned by defining additional
NameIDs in conf/saml-nameid.xml, e.g. here's what sending ePPN as
NameID would look like (with the formal attribute name URI for ePPN as
the NameID format):

  <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
        p:omitQualifiers="true"
        p:format="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
        p:attributeSourceIds="#{ {'eduPersonPrincipalName'} }" />

The SP's metadata would then include a NameIDFormat with the format
given above. (Or you'd create a relying-party override in case you
don't manage the metadata for this SP locally.)

-peter