Calculate ComputedId value outside of shibboleth idp

[Paul B. Henson]

On Fri, Jan 22, 2016 at 04:24:01AM +0000, Cantor, Scott wrote:

> Assume that you're joking, but of course the separator is quite
> necessary for reasons I guess I could point out, but will leave as an
> exercise for the reader.

Ok, I guess I'll put my dunce cap on today and say I'm flunking that
exercise :(. We've got three values:

X = entityid of requestor
Y = configured attribute
Z = configured salt

Why is sha1(X!Y!Z) a better hash than sha1 of (XYZ)? Mixing in the
entityid of the requestor makes it different for every SP. Mixing in the
attribute makes it unique but reproducible for every user. Mixing in the
secret salt makes it unguessable. What exactly do the exclamation marks
do?


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768