IDP V - 4.3.1 Deprecated SAML2NameID

[Cantor, Scott]

The feature is at risk but isn't being removed; the warning has been updated to reflect that.

Very few should need this, and the majority if not totality, of people who think they do are not bothering to investigate the actual need they have for it or what the SPs in use actually require.

There are only two supported mechanisms for passing a pairwise ID in SAML 2.0, one is the original persistent NameID and the other is the more recently defined pairwise-id Attribute. The deprecated AttributeEncoder is used for neither of those things.

My ability to explain any of this is greatly time constrained. When I have a chance I'll refresh the original summary of this mess [1] to include more updated information and get rid of most of the commentary, which is beside the point now. Much of what's there is out of date now so it's not a good reference point, just the only one there is at the moment.

The fundamentals:

- Stop supporting SAML 1.1 if you still are
- Stop sending NameIDs inside SAML AttributeValue elements using those deprecated AttributeEncoders, and just configure the normal persistent NameID support as documented
- Start supporting subject-id and pairwise-id Attributes when possible

-- Scott

[1] https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072511/NativeSPTargetedID