<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Yaowen,<div><br></div><div><div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">What I want to know is, if SP specify transient, it is very clear that the value will be a temporary number. but if SP specify "<a href="urn:mace:shibboleth:1.0:nameIdentifier">urn:mace:shibboleth:1.0:nameIdentifier</a>" as the format, SP still doesn't know what will be the value inside the NameID. SP only knows that this value can represent this user. It can be email address, give name, or what ever. This is defined by IdP. Is that correct? Is there a place that defined what can be put inside the "nameIdentifier" so IdP and SP will follow this rule?<br></span></blockquote><div><br></div><div><a href="urn:mace:shibboleth:1.0:nameIdentifier">urn:mace:shibboleth:1.0:nameIdentifier</a> has reasonably precisely defined semantics. See section 3.3 of the old Shibboleth specification:</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/download/attachments/2162702/internet2-mace-shibboleth-arch-protocols-200509.pdf?version=1&modificationDate=1336585664438">https://wiki.shibboleth.net/confluence/download/attachments/2162702/internet2-mace-shibboleth-arch-protocols-200509.pdf?version=1&modificationDate=1336585664438</a></div><div><br></div><div>It's effectively a legacy transientId for use with the Shibboleth edition of SAML 1.1.</div><br><blockquote type="cite">Also it says "urn.....<span style="color: rgb(153, 0, 0); ">shibboleth:1.0</span>:nameIdentifier", does it mean it only works for SAML1.0? If I send a SAML2.0 AuthnRequest, will IdP return this?<br></blockquote></div><br></div><div>The IdP could hypothetically be configured to send this NameID using the SAML 2.0 protocol, but I think that would be a very unwise choice.</div><div><br></div><div>There's a reason that identifiers are well-typed: so that the SP knows what, if anything, to do with them once they're received. I'd strongly suggest choosing the right identifier type for the identifier you'd like to send.</div><div><br></div><div>If you have a use case that you'd like to discuss, please let us know.</div><div><br></div><div>Take care,</div><div>Nate.</div></body></html>