Hey Vito,
Good question! The user can freely edit their email on the profile page without any verification. So, like you mentioned I would not use the email as a primary identifier. The user_id value would be safe to use if the system you are integrating with is not multi-tenant, or if the SAML response had another identifier to distinguish between differing financial institutions.
If you are wanting a globally unique indentifer then I would suggest creating a guid, and storing that value within the database.
Below is an example of returning a SSO response and returning a user level config object. What this will do is store the key/value pairs into a table called Q2_ThirdPartyData. Any data stored for this vendor and user will be passed back to you on subsequent SSO requests and could be used within the SAML response.
ul_config_list = [UserLevelConfig('saml_principal', guid)]
ul_config = sso_response.UserLevelConfigList(self.vendor_id, ul_config_list)
response = Q2SSOResponse(ResponseType.HTML, response=html, user_level_config_list=ul_config)
Hope this helps!
Jason
