PersistentNameIDGenerationConfiguration - Can the identifiers be computed outside of Shibboleth IdPv3?

[Rainer Hoerbe]

> 
>> I was wondering-- if the source attributes are available to a privileged administrator, can the IDs be generated en masse and an ID be matched up with the computed list?  Is there a particular algorithm used to do the mapping that is described somewhere (other than in the code)?
> 
> The IDs are specific to each SP, recall, not each user alone. So that's not one set, it's an infinite set (in the abstract).

In principle it should be possible to encrypt userid + sp-entityid with AES instead of a hash and thus be be both computed and reversible. 

- Rainer

> 
> It can be, but no, it's not described other than in code. The only scriptable way to do it right now would be by poking the aacli.sh script for a user, it will spit out the NameID it will use for a given SP.
> 
> The basic answer is, you probably wouldn't do this. You'd use the audit log to track back.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net