Question

A privacy engineer is reviewing a proposed single sign-on (SSO) architecture where a corporate identity provider (IdP) will federate authentication to a dozen internal applications. Each application currently maintains its own user profile store keyed by email address. Security wants to also pass a rich set of profile attributes (department, manager, phone, physical location) in every SAML assertion to reduce per-app lookups. From a privacy engineering standpoint, what is the MOST appropriate design recommendation?

Accepted Answer

Release only the minimal claims each application actually needs to function, using per-application attribute release policies at the IdP

Answer

Include all available profile attributes in every assertion so downstream applications never need to query the directory again

Answer

Encrypt the SAML assertion in transit so the full attribute set can be safely distributed to every application

Answer

Replace the email-based identifier with a random opaque identifier and pass the full attribute set to preserve linkability