Persistent NameID
Tom Poage
tfpoage at ucdavis.edu
Tue Feb 28 13:00:09 EST 2017
> I will say that if you can generate persistent IDs, you can probably provide eduPersonUniqueID also with the same underlying data, and should support them, but you absolutely need to take very special care not to use any identifiers that can differ only in case. And that's one of the major problems with persistent IDs (and the OpenID sub claim).
>
> I've already patched support for Base32 in place of Base64 encoding into the IdP, and I would not deploy persistent IDs from scratch at present without a custom fix applied to do that, which reminds me I need to make sure the documentation mentions that.
Good point about case. Looks there are several base-32 encodings to choose from, though I imagine wanting to entertain only those starting with "RFC".
Tom.
More information about the users
mailing list