Clustering IdPv3 and SAML 1 attribute query

[Cantor, Scott]

On 7/13/15, 2:04 PM, "users on behalf of Sara Hopkins" <users-bounces at shibboleth.net on behalf of sara.hopkins at ed.ac.uk> wrote:

>Excellent, many thanks Scott.

Subtle point in this area: this is why V3 IdPs will issue long, ugly transient NameIDs after an upgrade when they might have been using shorter UUIDs before. The default transient generation strategy used is the crypto strategy that seals the username in an encrypted blob so they're quite long.

This will happen *even if you have the old plugin in your V2 resolver config* because for transient IDs, the new generation layer trumps the old transientId in the resolver because it's functionally equiv.

So when people start seeing long IDs, that's why. People running the CryptoTransient plugins in V2 are used to them.

It defaults to this so that the client-side clustering supports attribute queries by default (thus your question).

-- Scott