Computed ID Data Connector

[Ian Young]

On 28 Mar 2014, at 14:10, Tom Scavo <trscavo at gmail.com> wrote:

> But I don't see why that is a requirement. The SAML V2.0 Persistent
> NameID (or eduPersonTargetedID) is a triple, not a single value, so
> the computed value doesn't need to be globally unique.

True, but you also don't particularly want a targeted ID to be reversible. If you didn't have the salt at all, then you'd be able to put prospective user IDs in one end and see the computed value come out the other, and build a table to reverse the targeted IDs. The salt makes this impossible. As does using a stored-value UUID-based scheme, of course.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5943 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20140328/8fb6067e/attachment.bin