Dear Q2 Staff: We are implementing an SSO flow using Q2 as identity provider (SAML 2.0). We are using the user email address as subject principal in the SAML response. It is the email that drives the uniquess of the identity. We noticed that a user can modify his/her email address freely in "Total Access" (bank website). Settings > Profile. Is the behavior the same in PRD? or does Q2 verify the email before a user changes his/her email? We are concerned that a user may use another user's email and sso as the another user. Thank you. Sample paylod: <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">john.smith@bankofkennesaw.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2022-02-01T23:30:50Z" Recipient="https://login-duo.dev.deluxe.com/sso/saml2/0oa20c66vvopLHxRF1d7" /> </saml:SubjectConfirmation> </saml:Subject>

Dear Q2 Staff: We are implementing an SSO flow using Q2 as identity provider (SAML 2.0). We are using the user email address as subject principal in the SAML response. It is the email that drives the uniquess of the identity. We noticed that a user can modify his/her email address freely in "Total Access" (bank website). Settings > Profile. Is the behavior the same in PRD? or does Q2 verify the email before a user changes his/her email? We are concerned that a user may use another user's email and sso as the another user. If the email is not verified, can you please recommend an attribute that uniquely and safely identifies a user? Would self.online_user.user_id work? Thank you. Sample paylod: <saml:Subject> <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">john.smith@bankofkennesaw.com</saml:NameID> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml:SubjectConfirmationData NotOnOrAfter="2022-02-01T23:30:50Z" Recipient="https://login-duo.dev.deluxe.com/sso/saml2/0oa20c66vvopLHxRF1d7" /> </saml:SubjectConfirmation> </saml:Subject>