saml proxying scoped attributes...best practice

[Cantor, Scott]

If you control the SPs, then my recommendation is that you should produce the standard subject-id Attribute for those SPs, probably basing it on a hash of a proxied identifier in the proxy case and locally managed in the local case.

I would never use uid for anything outside the IdP itself. It has no definition or semantics, so it's not suitable for anything.

-- Scott