computedID in idpv3

[Peter Schober]

* Paul B. Henson <henson at cpp.edu> [2016-02-15 22:37]:
> > ePTID is an abstraction. In SAML 2, it's intended expression is in the NameID,
> > from whence the concept was derived. The terminology makes it impossible
> > to tell what people really mean or expect, and that's one of the reasons for
> > getting rid of it at this stage of things.
> 
> Hmm, so an SP could say they require the ePTID, but they are
> actually using the SAML2 persistent ID, and they would work fine
> without a literal ePTID defined or released? That's rather confusing
> <sigh>.

The ePTID attribute is *defined* to have a persistent NameID as its
value, so it really is the same thing (just in two different potential
spots within a SAML Assertion: a canonical one and a "legacy" one) --
so accepting both is not so confusing after all.

Of course the ways to request it differ from attribute
(RequestedAttribute element in SAML Metadata) to Subject (NameIDFormat
elemet in SAML Metadata).
And then there are those that always include the canonical form in
meaning when they talk about the attribute.
So yeah, still sufficient room for confusion. All the more reason to
try getting rid of the attribute variant.

(OTOH: That change doesn't bring any new value for IDPs or SPs, but
causes work and sometimes breakage. It's unclear to me whether going
forward only having to deal with the canonical form will remove enough
confusion that this change is warranted now. Only one way to find out.)
-peter