The Shibboleth Idp also support per SP opaque nameID but nobody like SAML based protocol and as far as I know outside the academical identity federations, no one deploys Shibboleth ...
Shibboleth is terrible -- so terrible it was easier for me to write my own SAML IdP from the specification than try to make it useful. Lots of people use Active Directory Federated Services (ADFS), which has a SAML IdP.
