What is the purpose of nameidentifier claim?

Question

What the claim of type http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier should be used for?

This is the main question, and here are additional ones.

How does it differ from http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name claim?

Is it permanent for particular user as opposed to name claim?

Is it globally-scoped or IdP-scoped?

Periodicity

Did you ever find an answerto this, Anton? – Armentrout

Hi, @TommyJakobsen. Unfortunately, no. In the end, we didn't use this claim in our application. – Periodicity

Answer 1

Name, is just that a name. If we're talking person, think "Eric"; a server "file01".

A NameIdentifier is the ID for an object. Turning back to our person object, Eric's UserID might be 435 in your database. For the server the Identifier could be something like a FQDN or a SID.

According to this post, apparently Name Identifier was a SAML 1.1 property, and is being supplanted by NameID in SAML 2.0.

Unique or Not?

I wanted to address @Jason's comment and @nzpcmad's post. I don't see uniqueness as a clear cut requirement. The question is tagged adfs2.0 but the schema referenced is owned by OASIS. So those are the two parties interpretations we need to balance.

Microsoft's stance for ADFS is clearly that there is a unique requirement. We see that in the "The Role of Claims" article. No doubt ADFS casts a big shadow, but this seems like an implementation detail.

Looking at the SAML 1.1 spec, however, I see no such assertion. The closest we get in section 2.4.2.2 of spec is:

The element specifies a subject by a combination of a name qualifier, a name, and a format. The element has the following attributes:
...
NameQualifier[optional] The security or administrative domain that qualifies the name of the subject. This attribute provides a means to federate names from disparate user stores without collision.

The text of the spec tells me that I need to be able to find a person using a combination of the three attributes, but it makes no assertion as to uniqueness. Couldn't I have two entries that point to the same user? Seems so. Moreover, wouldn't' the spec indicate the NameQualifier attribute was required in cases where NameIdentifier was insufficient to uniquely identify the name?

So what's this all lead to?

• Be careful, unqiue is likely safer.
• Dig into your providers stance on the topic.

Complicacy

I think nzpcmad's answer adds more clarity here. A Name is not just a name if it is supposed to be unique. I was confused about whether I should use Name or NameIdentifier to store usernames. Now I know. – Kiley

Answer 2

Per The Role of Claims,

Name The unique name of the user

Name Identifier The SAML name identifier of the user

These two claims are part of the group of claims that AD FS 2.0 configures by default.

This implies that they are IP scoped.

e.g. when you log in to Google using ACS, "nameidentifier" is the unique GUID associated with your account by Google whereas name is your Google login e.g. "[email protected]".

Squirm

Thank you, @nzpcmad, for your attention. However it is still uncler to me what does "name identifier" mean. There is no explaination in "The SAML name identifier of the user" phrase. – Periodicity

Answer 3

ClaimTypes.Name is for username and ClaimTypes.NameIdentifier specifies identity of the user as object perspective. If you add them in a kind of ClaimIdentity object that provides you to reach User.Identity methods(for example in the dotnet world) which are GetUserName() and GetUserId().

Alienism

Answer 4

The nameidentifier claim should be used for getting a unique user name.

For Windows Authentication:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier domain\warlock

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 0#.w|domain\warlock

domain\warlock is a Windows Login name

For Claims Based Authentiacation:

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier [email protected]

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name 05.t|myidentityprovider|[email protected]

email was specified as the Identifier Claim

As you can see .../identity/claims/name describes name and identity provider as well.

Balancer

This example is not very clear, goes against the other two answers, and has no supporting evidence. Accepted answers say nameidentifier should basically be a unique integer or GUID and name should be the unique username. – Oglesby

Links are broken – Dim