Persistent NameID format with an attribute as NameID value

[Cantor, Scott]

I should say that, if as some of us do, you need to support persistent NameIDs *and* pairwise-id *and* OpenID pairwise in some combo, you certainly can go the attribute-resolver route to produce an Attribute on top of ComputedId or StoredId and leverage that for all of those things.

In the NameID case, you just do an attribute-sourced NameID and set the Format, instead of using the IdP's persistent NameID generator feature that tries to automate all that for you.

In hindsight, we were trying to separate the concepts in part because the SAML pairwise-id thing hadn't been done yet, we didn't even have OpenID support, and we were trying to avoid creating a) more options and b) continuing to confuse the two constructs within the configuration. NameIDs here, Attributes there. That was the idea. It didn't work.

But again, none of those things, nor what David posted, are "a SAML Attribute with a NameID as the value". I'm not even going to post what that is to just avoid further confusing matters, but just...no. And those responses illustrate that that's *not* what NSCH requires, whatever they may be saying.

Sounds like a plain old persistent NameID is fine.

-- Scott