Deprecation warning about SAML2NameID

[Peter Schober]

Julien via users <users at shibboleth.net> [2025-11-22 15:53 CET]:
> WARN [DEPRECATED:128] - xsi:type 'SAML2NameID', (file
> [conf/attribute-resolver.xml]): This will be removed in the next
> major version of this software; replacement is (none)
[...]
> However I've had a deeper look and, if I understood properly, I
> should not rely on such identifiers:

Well, both "proper" persistent NameIDs (sent in the Subject element of
the SAML Assertion) and "obsolete" persistent NameIDs sent as an
attribute value of the (deprecated) eduPersonTargetedID attribute
should be replaced with SAML PairwiseID going forward, see v2 of
saml2int.org

> But still digging, I've found that I could declare that attribute in
> another location: dist/conf/saml-nameid.xml

Nit: That's not generating an attribute, that's generating a
("proper", as per above) NameID from an attribute.

> So, at the end I'm a bit lost and I don't know what is the best to do.
> Shall I ignore the deprecation warning ? Shall I replace the persistent
> attribute by another one ? Shall I move to saml-nameid.xml ?

By definition such decisions do not only affect the IDP itself but
also any Service Providers you're federating with. As such you can't
really decide this without reviewing your configuration/deployment
more closely and possibly also talking to or changing the
configuration for individual Servce Providers:
If at least one Service Provider you care about still requires
eduPersonTargetedID then you still have to keep that in your
configuration. (Or work with the SP to change all existing records to
another identifier type/value, possibly.)

I.e., it makes no sense to change from eduPersonTargetedID to "proper"
persistent NameIDs or SAML PairwiseID, if the services being accessed
with your IDP do not support those.

> Because the upgrade is in-place, I fear to break something and would need
> some advices.

An upgrade is not the time to decide such things. Before, during and
after the upgrade focus on ensuring everything works as well as
before.
Once you're confident and have ensured that everything still works
you can start tackling that issue.

HTH,
-peter