eduPersonTargetedId question

[Mike Flynn]

Thank you.


________________________________
 From: "Cantor, Scott" <cantor.2 at osu.edu>
To: Shib Users <users at shibboleth.net> 
Sent: Wednesday, September 26, 2012 6:55 AM
Subject: Re: eduPersonTargetedId question
 
On 9/26/12 9:39 AM, "Nate Klingenstein" <ndk at internet2.edu> wrote:
>
>You're treating a string-like eduPersonTargetedID as a scoped
>eduPersonTargetedID.  This is understandable given ample early confusion
>about how to express the concept behind eduPersonTargetedID and whether
>it should be scoped.
>
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID

Yes, but what he's receiving is not only botched but wrong and dangerous.
It's an unqualified identifier that doesn't meet the criteria of simple
uniqueness. Do NOT accept it. The SP is protecting you; let it.

>The most expedient fix in your case would be to change the attribute
>decoder to a simple attribute decoder, and edit attribute-filter.xml to
>remove the scoping check.

Definitely do not do that. If what you were getting was an improperly
expressed botched attribute value with a scope, you can use the
NameIDFromScoped Attribute Decoder to normalize the value into the same
form as correctly asserted SAML persisent IDs. But you can't do that with
this one.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120926/994b286b/attachment-0001.html