Quiz Entry - updated: 2026.10.22
What is a SAML NameID, and why does the choice between a persistent and a transient format matter?
The NameID identifies the subject to the SP; a persistent NameID is a stable, opaque pseudonym per SP, a transient one changes with every login, and both avoid exposing a global identifier such as an e-mail address.
The Format attribute of <NameID> tells the SP what kind of identifier it is receiving:
| Format | What the SP gets | Good for |
|---|---|---|
persistent |
A random, long-lived value, different for each SP (a pairwise pseudonym) | Recognising a returning user and linking to a local account, without revealing who they are elsewhere |
transient |
A one-time value valid only for this session | Anonymous access where attributes ("is a student") are enough |
emailAddress / unspecified |
A readable identifier such as an e-mail | Simple integrations, at the cost of privacy and linkability |
The example assertion uses a persistent identifier (3f7b3dcf-1674-...). The privacy point: because each SP receives a different persistent value, two SPs cannot join their records on the identifier to track the user across services. That is federation with built-in data minimisation, an idea SAML 2.0 inherited from Liberty and Shibboleth.
Go deeper:
OASIS: SAML V2.0 Technical Overview — sections 5.4.3 and 5.4.4 cover federation with persistent and transient pseudonyms.- OASIS: SAML V2.0 Core specification (PDF) — section 8.3 lists all name identifier formats.