<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex" class="gmail_quote"><font face="arial, helvetica, sans-serif">On Tue, Oct 27, 2015 at 12:08 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br></font><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><font face="arial, helvetica, sans-serif">Either way, SAML Metadata and/or nameIDFormatPrecedence in the<br></font><font face="arial, helvetica, sans-serif">
appropriate relying party config are the answer for reliably<br></font><font face="arial, helvetica, sans-serif">
controlling the release of the right NameID.<br></font></blockquote></blockquote><div> </div><font face="arial, helvetica, sans-serif"></font><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"></blockquote><span style="font-family:arial,helvetica,sans-serif">Thanks for the hint; I have an analogous need.</span><br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote></blockquote></blockquote><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">In my (I think typical) case, there are multiple attributes with the "right" nameIDFormat or nameFormat.</span></div><div class="gmail_quote"><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">how could force the selection of ID# ? Is it sufficient to have a restrictive attribute release policy?</span><br><blockquote style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex" class="gmail_quote "><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"><blockquote><blockquote></blockquote></blockquote></blockquote></blockquote></blockquote><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">The documentation at </span><font color="#000000" face="arial, helvetica, sans-serif"><span style="line-height:20px;white-space:nowrap"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier</a>, in </span></font></div><div class="gmail_quote"><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">particular the section "IdP Name Identifier Selection Process," does not explicitly say the </span></div><div class="gmail_quote"><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">candidate attributes have to be allowed to the SP by the release policies in attribute-filter.xml, but I think</span></div><div class="gmail_quote"><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">they must be, yes?</span><br><blockquote style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex" class="gmail_quote "><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"><blockquote><blockquote></blockquote></blockquote></blockquote></blockquote></blockquote><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">Thanks,</span><br><span style="color:rgb(0,0,0);font-family:arial,helvetica,sans-serif;line-height:20px;white-space:nowrap">David Bantz</span></div><br></div></div>