PersistentId / principalName

[Ortner Nikolaus]

Hi,

I run a Shibboleth IdP (2.3.8) with a DataConnector xsi:type="StoredId" using a sourceAttributeID other than the requestContext.principalName.
Works fine, but I'm a bit concerned about changing or reusing user's principalName (which may occur occasionally).
[Maybe it is caused in my setup - LoginHandler is of type "UsernamePassword" and logins (username/password) are checked against an M$-ActiveDirectory server; all  attribute data is retrieved from an external database.]

As I see it right I'd have to update the principalName of the database entries holding the persistentId - a) to migrate existing IDs when an user's principalName changes and b) to avoid confusion if there is a possibility that a principalName will later be assigned to another person's account.
So am I expected to run into side-effects when updating records in this shibpid-table externally? (caching maybe?)

Leaving the shibpid-entries unchanged could also result in the wrong attributes resolved when using a IdPPersistentNameIdentifier (one my test SP issues an AttributeQuery after the AuthnRequest); just when the StoredIDPrincipalConnector resolves the wrong principalName for a given NameID.

I propose the StoredIDDataConnector.getStoredId() should update the principalName in case it has changed (and the principalName is not used as the localId).
And also some kind of error-handling when the IdP encounters a principalName resolving to two different active persistentId or a persistentId resolving to 2 different principalNames.

Kind regards,
	Nikolaus Ortner