StoredID/persistentID only when used?

[Cantor, Scott]

On 9/9/16, 10:07 AM, "users on behalf of Simon Lundström" <users-bounces at shibboleth.net on behalf of simlu at su.se> wrote:

> What we're trying to accomplish is to avoid generation (and storing in
> DB) and releasing (and thus fetching from DB) of the persistent ID.

I see. I guess it basically indicts the strategy of using a database if that's a concern.

> So we would like to only generate, store, fetch and release it when it's
> used; not always everytime to every SPs.

Well, that would require absolutely knowing when it's going to be used, and I'm afraid that's hard. Just relying on metadata doesn't do that, any SP could make a request for that format at any time. So you're talking about more code I suppose, copying stuff the IdP is doing to establish the format precedence for the request.

> Ah, which context should we use for this?

Many.

Selecting the format is algorithmic based on metadata, the request's content, and the profile configuration. If the request contains a Format, then it has no choice, that's the only Format allowed. So it marries that against the list returned by the DefaultNameIdentifierFormatStrategy Function to decide what to do and there's nothing exposed to do that, it's inside one of the action beans. Most of the logic is in DefaultNameIdentifierFormatStrategy to produce a list, but that doesn't take the request into account, that's done at the last minute.

The IdP has always taken the approach that it is essentially infeasible to decide how to conditionally resolve data. The conditional features added in V3 are targeted at simple cases where special needs are associated with very explicit SPs. It isn't really usable to change the fundamental assumption that resolve() has to resolve everything.

So, in looking at what you're saying here, I think your problem is that you're using the resolver, which is deprecated for this use case. If you don't use the resolver to produce the persistentID, you won't have this issue. The IdP only runs the generators if it needs to, which is the behavior you want, essentially using the IdP to decide when this is needed.

-- Scott