Shibboleth Developers

["Scott Cantor" <>]

> SAML1 has a nameID but shibb defines it's own namespace for this which 
> says it should be opaque and transient.

It says no such thing. It defines a means of doing this when you need to
because assuming privacy is a concern is a better default than not assuming
it.

> I haven't spotted this use case in SAML2 (maybe I'm missing something)

Yep.

Check section 8.3.7 of core. That is effectively the definition of eptid
that I want to move to.

-- Scott