storedID and IDP entityID changes
Peter Schober
peter.schober at univie.ac.at
Tue Feb 25 08:46:40 EST 2014
>From a recent discussion about what kind of changes (user principal,
SP entityID, IDP entityID?) the StoredID approach helps to protect
you, compared to ComputedIDs:
When changing the IDPs entityID (for whatever reason, obviously it
should never) the current StoredID implementation will issue the
current entityID as NameQualifier value, though the previously
generated one would be available in the RDBMS.
(The IDP looks for an existing persistentID matching its own entityID
as localEntity and will generate a new one otherwise.)
Would it make sense to have the IDP use the stored localEntity instead
in issued NameIDs? Necessarily the assertions Issuer wouldn't match
the NameQualifier value then. Not sure if this will break stuff.
If the IDP does not use the RDBMS abstraction layer for NameQualifier
values why does it store its own entityID as localEntity then? To
allow sharing of a single table in a single database on a single
server across several IDPs? (That's fully possible with that design,
I'm just asking whether that's an intended feature. Obviously that is
mutually exclusive with the change I'm asking above.)
Thanks,
-peter
More information about the dev
mailing list