Security Glossary

SAML NameID

The unique identifier for a user within a SAML assertion, typically formatted as an email address, persistent ID, or transient identifier.

SAML NameID is the element within a SAML assertion that uniquely identifies the authenticated user. The format and value are determined by the Identity Provider and must be understood by the Service Provider to map to a local account.

Common Formats

<!-- Email Address -->
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
  user@example.com
</saml:NameID>

<!-- Persistent (opaque, stable identifier) -->
<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
  G3k5j2Hw9xPq...
</saml:NameID>

<!-- Transient (changes each session) -->
<saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">
  _abc123session...
</saml:NameID>

<!-- Unspecified -->
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
  jdoe
</saml:NameID>

NameID Vulnerabilities

Comment Injection

<!-- Well-formed empty comment (<!---->) injected mid-value -->
<saml:NameID>admin@example.com<!---->.evil.com</saml:NameID>

<!-- Full text value: admin@example.com<!---->.evil.com -->
<!-- Parsers that drop the comment and return only the -->
<!-- first text node read: admin@example.com -->

Truncation Attacks

<!-- If SP truncates at first null byte or special char -->
<saml:NameID>admin@example.com%00@evil.com</saml:NameID>

Security Considerations

  • Validate NameID format matches expected
  • Be aware of XML parsing quirks (comments, encoding)
  • Normalize before comparison
  • Consider case sensitivity for email formats

PentesterLab Exercises

See Also