What is the purpose of nameidentifier claim?

问题:

What the claim of type http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier should be used for?

This is the main question, and here are additional ones.

How does it differ from http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name claim?

Is it permanent for particular user as opposed to name claim?

Is it globally-scoped or IdP-scoped?

回答1:

Name, is just that a name. If we're talking person, think "Eric"; a server "file01".

A NameIdentifier is the ID for an object. Turning back to our person object, Eric's UserID might be 435 in your database. For the server the Identifier could be something like a FQDN or a SID.

According to this post, apparently Name Identifier was a SAML 1.1 property, and is being supplanted by NameID in SAML 2.0.

Unique or Not?

I wanted to address @Jason's comment and @nzpcmad's post. I don't see uniqueness as a clear cut requirement. The question is tagged adfs2.0 but the schema referenced is owned by OASIS. So those are the two parties interpretations we need to balance.

Microsoft's stance for ADFS is clearly that there is a unique requirement. We see that in the "The Role of Claims" article. No doubt ADFS casts a big shadow, but this seems like an implementation detail.

Looking at the SAML 1.1 spec, however, I see no such assertion. The closest we get in section 2.4.2.2 of spec is:

The element specifies a subject by a combination of a name qualifier, a name, and a format. The element has the following attributes:
...
NameQualifier[optional] The security or administrative domain that qualifies the name of the subject. This attribute provides a means to federate names from disparate user stores without collision.

The text of the spec tells me that I need to be able to find a person using a combination of the three attributes, but it makes no assertion as to uniqueness. Couldn't I have two entries that point to the same user? Seems so. Moreover, wouldn't' the spec indicate the NameQualifier attribute was required in cases where NameIdentifier was insufficient to uniquely identify the name?

So what's this all lead to?

• Be careful, unqiue is likely safer.
• Dig into your providers stance on the topic.

回答2:

Per The Role of Claims,

Name The unique name of the user

Name Identifier The SAML name identifier of the user

These two claims are part of the group of claims that AD FS 2.0 configures by default.

This implies that they are IP scoped.

e.g. when you log in to Google using ACS, "nameidentifier" is the unique GUID associated with your account by Google whereas name is your Google login e.g. "[e-mail]".

回答3:

ClaimTypes.Name is for UserName and ClaimTypes.NameIdentifier specifies identity of the user. If you add them in ClaimIdentity object that provides you to reach User.Identity methods which are GetUserName() and GetUserId().

回答4:

The nameidentifier claim should be used for getting a unique user name.

For Windows Authentication:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier domain\warlock

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 0#.w|domain\warlock

domain\warlock is a Windows Login name

For Claims Based Authentiacation:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier [e-mail]

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 05.t|myidentityprovider|[e-mail]

email was specified as the Identifier Claim

As you can see .../identity/claims/name describes name and identity provider as well.