PersistentNameIDGenerationConfiguration - Can the identifiers be computed outside of Shibboleth IdPv3?

[Cantor, Scott]

On 3/16/16, 3:00 PM, "users on behalf of Waldbieser, Carl" <users-bounces at shibboleth.net on behalf of waldbiec at lafayette.edu> wrote:



>I was wondering-- if the source attributes are available to a privileged administrator, can the IDs be generated en masse and an ID be matched up with the computed list?  Is there a particular algorithm used to do the mapping that is described somewhere (other than in the code)?

The IDs are specific to each SP, recall, not each user alone. So that's not one set, it's an infinite set (in the abstract).

It can be, but no, it's not described other than in code. The only scriptable way to do it right now would be by poking the aacli.sh script for a user, it will spit out the NameID it will use for a given SP.

The basic answer is, you probably wouldn't do this. You'd use the audit log to track back.

-- Scott