ArtStore regarding SSO

[Cantor, Scott]

On 11/18/16, 6:04 PM, "users on behalf of Dr_Natas" <users-bounces at shibboleth.net on behalf of Juan.Rios at csuci.edu> wrote:

> New to Shibboleth here. We just spoke to customer support for ArtStor and
>    they wanted us to release the "EduPersonTargetedId". Does this mean that I
>    have to add to our attribute-filter.xml?

You are missing a ton of background.

eduPersonTargetedID is an unfortunate historical accident that refers to something in SAML called a persistent NameID. It's an opaque identifier that's different for every user / service provider pair. It's called a pairwise identifier. It's for privacy preserving interactions. It is not storable in LDAP. It is complex to understand, use, and support. It requires database support or an IDM-supplied value that is appropriately stable. Not every organization can support either of those things, and you should not support it if you can't support it properly.

Most library services may *support* an identifier for tracking searches and other things but that doesn't mean they should be requiring them. If you don't have a strong need, I would advise you to punt on this until you have much more understanding and time to spend on it.

Other applications almost never work well with pairwise identifiers and are better handled with a global identifier, be it eduPersonUniqueID, a non-reassigned eduPersonPrincipalName, or other proprietary attributes. 

Mechanically, if you really have to do this, you do it the way Nate described and configure support for persistent NameIDs and configure a relying party override to specify that Format for ArtStor. Supporting them requires a database or hashing based on a stable seed. That cannot be the username or anything derived from it.

-- Scott