Differentiate between metadata NameIDFormat and AuthnRequest NameIDPolicy Format

The `name_id_format` configuration option is used to define

1. the value of the `<NameIDFormat>` metadata element
2. and the value of the `<NameIDPolicy>` `Format` attribute in an `AuthnRequest`

The configuration option to set what the value of `<NameIDFormat>` element is in the
metadata should be different from the configuration option to specify what should be
requested in an `AuthnRequest` through the `<NameIDPolicy Format="...">` attribute.

Introduce a new option (`name_id_policy_format`), or use the same name but scoped in a
specific section for metadata and AuthnRequest.

On the side of this, pysaml2 defaults to _transient_ as the `<NameIDPolicy
Format="...">` attribute value. To omit requesting a value for the `<NameIDPolicy
Format="">` attribute the value `"None"` (a string) must be set in the configuration.
This is unintuitive. It is better to be explicit and set transient to request a
transient NameID, than not setting a value and requesting transient by default. If no
value is set, no specific `<NameIDPolicy Format="...">` should be requested.

- Refactor the name_id_format usage
- Add name_id_policy_format configuration option
- Remove the "None" convention value

Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>

3 files changed, 23 insertions, 26 deletions

diff --git a/src/saml2/client_base.py b/src/saml2/client_base.py
index ad7de4ef..564f657e 100644
--- a/src/saml2/client_base.py
+++ b/src/saml2/client_base.py
@@ -288,7 +288,7 @@ class Base(Entity):
         :param vorg: The virtual organization the service belongs to.
         :param scoping: The scope of the request
         :param binding: The protocol to use for the Response !!
-        :param nameid_format: Format of the NameID
+        :param nameid_format: Format of the NameIDPolicy
         :param service_url_binding: Where the reply should be sent dependent
             on reply binding.
         :param message_id: The identifier for this request
@@ -351,29 +351,20 @@ class Base(Entity):
                 raise ValueError("Wrong type for param {name}".format(name=param))
 
         # NameIDPolicy
-        nameid_format_config = self.config.getattr("name_id_format", "sp")
-        nameid_format_config = (
-            nameid_format_config[0]
-            if isinstance(nameid_format_config, list)
-            else nameid_format_config
-        )
-        nameid_format = (
+        nameid_policy_format_config = self.config.getattr("name_id_policy_format", "sp")
+        nameid_policy_format = (
             nameid_format
-            if nameid_format is not None
-            else NAMEID_FORMAT_TRANSIENT
-            if nameid_format_config is None
-            else None
-            if nameid_format_config == 'None'
-            else nameid_format_config
+            or nameid_policy_format_config
+            or None
         )
 
         allow_create_config = self.config.getattr("name_id_format_allow_create", "sp")
         allow_create = (
             None
             # SAML 2.0 errata says AllowCreate MUST NOT be used for transient ids
-            if nameid_format == NAMEID_FORMAT_TRANSIENT
+            if nameid_policy_format == NAMEID_FORMAT_TRANSIENT
             else allow_create
-            if allow_create is not None
+            if allow_create
             else str(bool(allow_create_config)).lower()
         )
 
@@ -381,13 +372,15 @@ class Base(Entity):
             kwargs.pop("name_id_policy", None)
             if "name_id_policy" in kwargs
             else None
-            if nameid_format == ""
-            else samlp.NameIDPolicy(allow_create=allow_create, format=nameid_format)
+            if not nameid_policy_format
+            else samlp.NameIDPolicy(
+                allow_create=allow_create, format=nameid_policy_format
+            )
         )
 
         if name_id_policy and vorg:
             name_id_policy.sp_name_qualifier = vorg
-            name_id_policy.format = nameid_format or NAMEID_FORMAT_PERSISTENT
+            name_id_policy.format = nameid_policy_format or NAMEID_FORMAT_PERSISTENT
 
         args["name_id_policy"] = name_id_policy
 
diff --git a/src/saml2/config.py b/src/saml2/config.py
index 147d1bdf..278aba16 100644
--- a/src/saml2/config.py
+++ b/src/saml2/config.py
@@ -89,6 +89,7 @@ SP_ARGS = [
     "allow_unsolicited",
     "ecp",
     "name_id_format",
+    "name_id_policy_format",
     "name_id_format_allow_create",
     "logout_requests_signed",
     "requested_attribute_name_format",
@@ -209,6 +210,7 @@ class Config(object):
         self.contact_person = None
         self.name_form = None
         self.name_id_format = None
+        self.name_id_policy_format = None
         self.name_id_format_allow_create = None
         self.virtual_organization = None
         self.only_use_keys_in_metadata = True
diff --git a/src/saml2/metadata.py b/src/saml2/metadata.py
index b2317131..d80b41ac 100644
--- a/src/saml2/metadata.py
+++ b/src/saml2/metadata.py
@@ -379,13 +379,15 @@ def do_extensions(mname, item):
 
 
 def _do_nameid_format(cls, conf, typ):
-    namef = conf.getattr("name_id_format", typ)
-    if namef:
-        if isinstance(namef, six.string_types):
-            ids = [md.NameIDFormat(namef)]
-        else:
-            ids = [md.NameIDFormat(text=form) for form in namef]
-        setattr(cls, "name_id_format", ids)
+    name_id_format = conf.getattr("name_id_format", typ)
+    if not name_id_format:
+        return
+
+    if isinstance(name_id_format, six.string_types):
+        name_id_format = [name_id_format]
+
+    formats = [md.NameIDFormat(text=format) for format in name_id_format]
+    setattr(cls, "name_id_format", formats)
 
 
 def do_endpoints(conf, endpoints):