Document changes to NameIDFormat

docs/simplesamlphp-reference-idp-hosted.md

@@ -222,8 +222,11 @@ The following SAML 2.0 options are available:
 :   Note that this option can be set for each SP in the [SP-remote metadata](./simplesamlphp-reference-sp-remote).
 
 `NameIDFormat`
-:   The format of the NameID supported by this IdP. Defaults to the `transient` format if unspecified.
-    This parameter can be configured in multiple places, and the actual value used is fetched from metadata with
+:   The format(s) of the NameID supported by this IdP, as either an array or a string. If an array is given, the first
+    value is used as the default if the incoming request does not specify a preference. Defaults to the `transient`
+    format if unspecified.
+
+:   This parameter can be configured in multiple places, and the actual value used is fetched from metadata with
     the following priority:
 
 :   1.  SP Remote Metadata
@@ -243,7 +246,7 @@ The following SAML 2.0 options are available:
     you should configure [NameID generation filters](./saml:nameid)
     on your IdP.
 
-:   Note that the value set here will be added to the metadata generated for this IdP,
+:   Note that the value(s) set here will be added to the metadata generated for this IdP,
     in the `NameIDFormat` element.
 
 `RegistrationInfo`

docs/simplesamlphp-reference-sp-remote.md

@@ -174,8 +174,10 @@ The following SAML 2.0 options are available:
     `FALSE`.
 
 `NameIDFormat`
-:   The `NameIDFormat` this SP should receive. The three most commonly
-    used values are:
+:   The `NameIDFormat` this SP should receive. This may be specified as either a string or an array, but if an array
+    is given, the first format specified will be the one requested during an authentication request.
+
+:   The three most commonly used values are:
 
 :   1.  `urn:oasis:names:tc:SAML:2.0:nameid-format:transient`
     2.  `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
@@ -371,13 +373,13 @@ relevant for this sp. The final list is the concatenation of the list
 given as parameter to InitSSO (at the sp), the list configured at the
 sp and the list configured at the ipd (here) for this sp. The intersection
 of the final list and the idps configured at the at this idp will be
-presented to the user at the discovery service if neccessary. If only one 
+presented to the user at the discovery service if neccessary. If only one
 idp is in the intersection the discoveryservice will go directly to the idp.
 
 **Example: Configuration for scoping**
 
      'IDPList' => array('https://idp1.wayf.dk', 'https://idp2.wayf.dk'),
-     
+
 
 Shibboleth 1.3 options
 ----------------------