Docusign

[Andrew Morgan]

On Tue, 9 Aug 2016, Cantor, Scott wrote:

>> We released our OSU ID number to Docusign as the NameID.  It's as
>> persistent as anything we support right now.  Ideally, we would have a
>> person registry identifier we could release instead.
>
> That's not a SAML persistent ID. I would never want to be in a situation 
> where a Format is RP-specific (one thing for A and another for B). I 
> have refused to do that in a number of cases.
>
> If they require "persistent", they'd better hande a long, ugly, 
> impossible to predict value.

Oops, you're right.  I forgot that persistent has a specific meaning in 
SAML!  I haven't enabled the SAML2PersistentGenerator yet because we 
didn't have a need for it.

I enabled the SAML2PersistentGenerator using computedID based on our OSU 
ID number attribute.  Docusign accepted the new identifier with a long 
ugly value just fine.  Long term, we probably need to find an IAM-managed 
attribute to use as the source of the computedID instead of basing it on 
our OSU ID number.

Thanks,
 	Andy