This page explains the NameID settings for external IdP (SAML) integration.
NameID is a value that the IdP* sends to identify the user during SAML authentication.
TrustLogin uses this value to identify the corresponding member account and complete authentication.
*An external SAML Identity Provider (IdP), such as Salesforce, Google Workspace, or Entra ID
NameID Format
Overview:
This is an item included in the authentication request (AuthnRequest) that TrustLogin sends to the IdP.
It is used to tell the IdP "which format you want the NameID to be returned in."
Options:
| Value | Purpose |
|---|---|
| urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress | Select this if the IdP returns the NameID in email address format. |
| urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified | Select this if you want to leave the format up to the IdP, or if the IdP sends a value other than an email address (such as an employee ID) as the NameID. |
Please check the SAML settings of the connected IdP before making your selection.
Note:
The value specified here only functions as the requested format in the AuthnRequest.
The actual format of the NameID returned by the IdP is determined by the IdP's own settings.
If authentication does not work correctly after configuration, check the NameID Format setting in the SAML settings of the connected IdP.
Preferred NameID Attribute
Overview:
This is an item that specifies which member attribute within TrustLogin is matched against the NameID received from the IdP.
It is used to specify the priority order for matching.
Options:
| Value | Matching Order |
|---|---|
| Email Address | ① Match against email address → if no match, ② match against login ID |
| Login ID | ① Match against login ID → if no match, ② match against email address |
If neither matches, authentication will fail.
Note:
If the same value is registered as the email address for one member and the login ID for another member, the member whose
attribute matches the specified Preferred NameID Attribute will be authenticated preferentially.
To prevent unintended linking to the wrong account, please specify this setting appropriately for your operational needs.
Note: Login ID is available with the SSO Pro Plan and the SSO Pro + SaaS Management Plan. For pricing, click here
Case Sensitivity
Overview:
This is an item that specifies whether to distinguish between uppercase and lowercase letters when matching the NameID.
It is used to accommodate variations in the notation of the NameID sent by the IdP. The default is off.
| Value | Behavior |
|---|---|
| On | Matches with case sensitivity. Example: USER01 and user01 are treated as different users. |
| Off | Matches while ignoring case differences. Example: USER01 and user01 are treated as the same user. |
Example Setting Combinations
NameID Format specifies the format sent to the IdP, while Preferred NameID Attribute specifies the matching target within TrustLogin; the two operate at different layers. Combinations other than those below can also be configured.
| NameID Format | Preferred NameID Attribute | Expected Use Case |
|---|---|---|
emailAddress |
Email Address | A conventional configuration where the IdP sends the email address as the NameID |
unspecified |
Login ID | A configuration where the IdP sends a value other than an email address (such as an employee ID) as the NameID |