Persistent ID instead of Transient Name ID

[Peter Schober]

Dave Perry via users <users at shibboleth.net> [2023-01-11 17:02]:
> If it helps, we send eduPersonTargetedID as a 'persistent' attribute.

It doesn't, see the DEPRECATED warnings about that in your process log. ;)

Mak, Steven via users <users at shibboleth.net> [2023-01-11 17:03]:
> This vendor is actually asking for the protocol-compliant persistent
> format NameID, which is refreshing.

Well, section 2.1 of
https://wiki.oasis-open.org/security/SAMLSubjectIDAttr
details why some no longer find this refreshing. :-\

(It may still turn out to have been a mistake to try to rectify the
current situation, making it worse in the process by adding Yet More
identifiers, but at least we've tried.)

> Regarding the SP metadata, you MAY have to delete the "unspecified"
> line.

That should never be necessary:
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631686/ProfileConfiguration-SAML2SSO#Guidance
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631671/NameIDGenerationConfiguration#%5BinlineExtension%5DFormat-Selection

So given the metadata I'd expect the IDP to:
* ignore "unspecified"
* not have emailAddress available/defined (otherwise add override for persistent)
* release persistent, if/once added to configuration
* otherwise fall back to transient, which will NOT allow the SP to
  identify returning users, so doesn't meet the requirements as stated
  in prose ("opaque, unique, and unchanging").

HTH,
-peter