PersistentNameIDGenerationConfiguration - Can the identifiers be computed outside of Shibboleth IdPv3?

[Cantor, Scott]

On 3/16/16, 3:20 PM, "users on behalf of Rainer Hoerbe" <users-bounces at shibboleth.net on behalf of rainer at hoerbe.at> wrote:


>
>In principle it should be possible to encrypt userid + sp-entityid with AES instead of a hash and thus be be both computed and reversible.

It is, but at the time this was done, the IdP didn't have an AES key or any code designed for that and everything since then has been done to maintain compatibility with the hashing approach that was used. Whether it was good, bad, or indifferent wasn't a factor.

Also, reversibility isn't really the main limitation (you don't need to reverse them, generally), the ability to revoke or change them is, and that still isn't possible with a computed approach or at best a hybrid that still involves state.

I think the confusion of introducing yet another computed algorithm and keeping people from accidentally using it and changing all their IDs is a bigger risk than the benefit, but that's not entirely for me to say.

-- Scott