Computed ID Data Connector

[Tom Scavo]

On Fri, Mar 28, 2014 at 10:29 AM, Ian Young <ian at iay.org.uk> wrote:
>
> On 28 Mar 2014, at 14:10, Tom Scavo <trscavo at gmail.com> wrote:
>
>> But I don't see why that is a requirement. The SAML V2.0 Persistent
>> NameID (or eduPersonTargetedID) is a triple, not a single value, so
>> the computed value doesn't need to be globally unique.
>
> True, but you also don't particularly want a targeted ID to be reversible. If you didn't have the salt at all, then you'd be able to put prospective user IDs in one end and see the computed value come out the other, and build a table to reverse the targeted IDs. The salt makes this impossible. As does using a stored-value UUID-based scheme, of course.

Yes, I understand that, but I wasn't referring to the salt, I was
referring to the IdP entityID. Apparently an implementation could bake
that into the computation (or not) but I'm trying to understand if
that's a *necessary* requirement in some sense. Seems the answer is
no. Indeed, Rod says the current implementation does not.

Tom