Different ComputedID for some (not all) users on 3.2.1?

[Sean Mason]

Hello all,
I am attempting to migrate from an 'old' shibboleth identity provider (v. 2.4.2) to the newest version (3.2.1) and I've run into an issue I cannot seem to figure out.

We have a (perceived?) need to generate 'eduPersonTargetedId', and we've been accomplishing that using the ComputedId data connector, using an active directory 'objectGUID' as the attribute source:

<resolver:DataConnector id="eduPersonTargetedId_Generator" xsi:type="dc:ComputedId"
                   generatedAttributeID="computed_eduPersonTargetedID"
                   sourceAttributeID="objectGUID"
                   salt="secret string...">
           <resolver:Dependency ref="ad_name" />
</resolver:DataConnector>

This configuration was migrated to the v3.2.1 instance and appears to "mostly" work.  "Mostly" refers to the fact that for the same objectGUID, same SP entityID, and same salt, the 2.4.2 instance produces a different value than the 3.2.1 instance for approximately 30% of users (of a very small sample size of 12).  For others the value remains the same.

Has anyone else experienced this behavior?  Is there some way to correct it? Any advice would very appreciated.

Thank you,
Sean