Non-transient NameID format

By default, AM as an IDP uses the NameID format urn:oasis:names:tc:SAML:2.0:nameid-format:transient. For more information, refer to Hosted identity provider configuration properties in AM’s SAML v2.0 guide.

When the IDP uses another NameID format, configure PingGateway to use that NameID format by editing the Fedlet configuration file sp-extended.xml:

To use the NameID value provided by the IDP, add the following attribute:

<Attribute name="useNameIDAsSPUserID">
  <Value>true</Value>
</Attribute>

To use an attribute from the assertion, add the following attribute:

<Attribute name="autofedEnabled">
  <Value>true</Value>
</Attribute>
<Attribute name="autofedAttribute">
  <Value>sn</Value>
</Attribute>

This example uses the value in SN to identify the subject.

Although PingGateway supports the persistent NameID format, PingGateway does not store the mapping. To configure this behavior, edit the file sp-extended.xml:

To disable attempts to persist the user mapping, add the following attribute:

<Attribute name="spDoNotWriteFederationInfo">
  <Value>true</Value>
</Attribute>

To enable attempts to persist the user mapping, add the following attribute:

<Attribute name="spDoNotWriteFederationInfo">
  <Value>false</Value>
</Attribute>

If a login request doesn’t contain a NameID format query parameter, the value is defined by the presence and content of the NameID format list for the SP and IDP. For example, an SP-initiated login can be constructed with the binding and NameIDFormat as a parameter, as follows:

http://fedlet.example.org:7070/fedlet/SPInitiatedSSO?binding=urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST&NameIDFormat=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

When the NameID format is provided in a list, it is resolved as follows:

If both the IDP and SP have a list, the first matching NameID format in the lists.
If either the IDP or SP list is empty, the first NameID format in the other list.
If neither the IDP nor SP has a list, AM defaults to transient and PingGateway defaults to persistent.

PingGateway 2024.9

Non-transient NameID format