Clustering IdPv3 and SAML 1 attribute query

[Sara Hopkins]

Hey Scott,

Many thanks for the additional info.

Cheers,

Sara

On 13/07/2015 19:21, Cantor, Scott wrote:
> On 7/13/15, 2:04 PM, "users on behalf of Sara Hopkins" <users-bounces at shibboleth.net on behalf of sara.hopkins at ed.ac.uk> wrote:
>
>> Excellent, many thanks Scott.
>
> Subtle point in this area: this is why V3 IdPs will issue long, ugly transient NameIDs after an upgrade when they might have been using shorter UUIDs before. The default transient generation strategy used is the crypto strategy that seals the username in an encrypted blob so they're quite long.
>
> This will happen *even if you have the old plugin in your V2 resolver config* because for transient IDs, the new generation layer trumps the old transientId in the resolver because it's functionally equiv.
>
> So when people start seeing long IDs, that's why. People running the CryptoTransient plugins in V2 are used to them.
>
> It defaults to this so that the client-side clustering supports attribute queries by default (thus your question).
>
> -- Scott
>

-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.