Proxying a Persistent NameID

[Cantor, Scott]

> Are there any best practices on this topic ? 

Avoiding pairwise IDs like the plague would be my opinion as to best practice. Avoiding NameIDs at all costs in all cases is the even more important one.

Virtually no SP *requires* a pairwise ID. Most of them don't even know what they mean and abuse NameIDs and Formats altogether. When they say "peristent", they really almost always mean "not transient", i.e. something stable. That doesn't require a pairwise ID.

That aside, you can't typically "proxy" a pairwise ID without recreating it because the proxied IdP is going to hand you the same value every time, you're the SP in that scenario to it. For you to hand out a pairwise ID, it has to vary based on who you're talking to so you can't just pass the original through.

Even if you're emulating the proxied IdPs to all your SPs so as to be a transparent proxy, you'd have to handle pairwise IDs at that spot to get them issued properly.

-- Scott