Persistent NameID format with an attribute as NameID value

[Wessel, Keith]

Hi, all,

It pained me to write that subject line.

We're updating to a newer SSO integration with the National Student Clearinghouse. They tell me they need a persistent Name ID. That is, the name ID format needs to be set to urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. But they also tell me that the value we send will be user-visible.

While I'm tempted to say that we'll just send them the usual pairwise persistent ID that, while not pretty, at least works out of the box, I figured I'd at least explore doing what our registrar's office wanted.

How would I get the IdP to use an attribute-sourced Name ID generator that sends an attribute as the Name ID but with a format of persistent?

Thanks,
Keith