Docusign

[Andrew Morgan]

On Tue, 9 Aug 2016, Andrew Morgan wrote:

> On Tue, 9 Aug 2016, Cantor, Scott wrote:
>
>>> We released our OSU ID number to Docusign as the NameID.  It's as
>>> persistent as anything we support right now.  Ideally, we would have a
>>> person registry identifier we could release instead.
>> 
>> That's not a SAML persistent ID. I would never want to be in a situation 
>> where a Format is RP-specific (one thing for A and another for B). I have 
>> refused to do that in a number of cases.
>> 
>> If they require "persistent", they'd better hande a long, ugly, impossible 
>> to predict value.
>
> Oops, you're right.  I forgot that persistent has a specific meaning in SAML! 
> I haven't enabled the SAML2PersistentGenerator yet because we didn't have a 
> need for it.
>
> I enabled the SAML2PersistentGenerator using computedID based on our OSU ID 
> number attribute.  Docusign accepted the new identifier with a long ugly 
> value just fine.  Long term, we probably need to find an IAM-managed 
> attribute to use as the source of the computedID instead of basing it on our 
> OSU ID number.

Reviving this topic because we need to roll out Docusign for real soon...

What happens if the source attribute for the Computed ID isn't present?  I 
assume the IDP will be unable to generate a persistent NameID, but 
otherwise nothing in the IDP will blow-up in a painful way.

We have an existing identifier that we could use nicely as the source 
attribute, but there are a special type of accounts (we will retire their 
usage eventually) that don't have this identifier.

Thanks,
 	Andy