PersistentNameIDGenerationConfiguration - Can the identifiers be computed outside of Shibboleth IdPv3?

[Paul B. Henson]

On Wed, Mar 16, 2016 at 03:00:23PM -0400, Waldbieser, Carl wrote:

> I was wondering-- if the source attributes are available to a
> privileged administrator, can the IDs be generated en masse and an ID
> be matched up with the computed list?  Is there a particular algorithm
> used to do the mapping that is described somewhere (other than in the
> code)?

I recently had a need to generate a bunch of eduPersonTargetedID's
(basically equivilent to the SAML2PersistentID as I understand it), and
the following perl script did the trick (entityid is the entityid of the SP
being accessed, attr is the source attribute, and salt is, well, the
salt):



#! /usr/bin/perl

use strict;
use warnings;

use Digest::SHA qw(sha1_base64);

my $entityid = $ARGV[0];
my $attr = $ARGV[1];
my $salt = $ARGV[2];
my $digest = sha1_base64($entityid . '!' . $attr . '!' . $salt);
my $pad = 4 - (length($digest) % 4);
print $digest; print '=' x $pad; print "\n";


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768