IdPv3 and Hathitrust: how to resolve and release SAML

[Peter Schober]

* Wang, Lihua <lwang2 at gc.cuny.edu> [2017-07-10 20:40]:
> Based on the following article: [...]
>
> GUID seems really really stable (unique across the world, and it ACTUALLY will never change.
> 
> Does it make sense to use GUID of active directory as the seed?

Scott already commented on that:

* Cantor, Scott <cantor.2 at osu.edu> [2017-07-10 18:49]:
> If your sAMAccountName values are unstable, or in any way technology
> dependent, then they are not appropriate.

AFAIU any operational data with an LDAP directory (maintained by the
server software, i.e., it's not your data) cannot possibly fulfill
common requirements for stable identifiers.

Simple example: Some admin by mistake deletes an account (or a few
thousand), detects the mistake, and corrects it by re-syncing the
directory to the Systems of Record (HR, SIS, library, etc.).
All accounts are now back -- but they also all have new GUIS (or
entityUUIDs or whatever), and with no way to change their values, as
they're server-maintained.

Instead of the (department?) admin making a mistake it could also be a
process running wild, a faulty IDM component, or your AD forrests
going down in flames, to be restored from scratch. All your data will
be there but will the original GUIDs and friends?

(The "tocal loss of everything" case might be sufficiently unlikely to
accept that risk. The other examples above -- faulty software or human
error -- maybe no so easily.)
-peter