RE: [security-services] Errata for NameIDPolicy

> Is there any constraints on the NameID values in 
> SubjectConfirmation (related to NameIDPolicy)? 

I don't think so, because the basic idea behind that was to be able to
identify attesting entities using SAML syntax, but NameIDPolicy is only
about the subject.

In most of the use cases I know of, attesting NameIDs are often system
entities.

Thx,
Scott