Custom Name Identifier
Custom name identifiers have the following properties:
arbitrary, but usually somewhat long-lived
by default, the IdP isn't able to reverse the mapping at all
Define the Attribute
A custom name identifier is typically created in two steps:
- Create an attribute definition to use as the basis of the identifier. This can be done directly on top of a raw source attribute or a higher-level attribute definition. The IdPAddAttribute topic includes information on this step.
- Attach SAML 1 Name Identifier and/or SAML 2 NameID attribute encoders to the attribute definition.
nameFormat choice is essentially arbitrary. SAML defines a few poorly specified options for some common syntaxes like email addresses or distinguished names, but in many cases the best choice is to invent a format that you control, or if you must, use the "unspecified" option as above.
The example above is merely one approach. Anything you can attach the necessary encoders to can be turned into an identifier, as long as you're willing to break the reverse mapping capability of the IdP or produce the necessary
Release the Attribute
Finally, define an attribute filter policy that releases the internal attribute to the intended relying parties.