EduPersonTargetedId

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2018-01-15 23:31]:
> The standard pairwise ID for SAML is a new SAML Attribute that's
> going through a final round of edits and review early this
> year. eduPersonTargetedID is dead and persistent NameIDs (and all
> NameIDs period) are dead. From a best practice perspective anyway.

What are the plans for the IDP to produce those identifiers easily?

For subject-id it's easy with a script, e.g. I've been creating
eduPersonUniqueIDs from the properties for SAML NameIDs in
conf/saml-nameid.properties, and it's trivial to reassert that as
subject-id attribute:

  <!-- Re-use sourceAttr and salt from persistentId definition from conf/saml-nameid.properties -->
  <AttributeDefinition id="eduPersonUniqueId" xsi:type="ScriptedAttribute">
    <Dependency ref="myLDAP" />
    <DisplayName xml:lang="en">Opaque user identifier</DisplayName>
    <Script><![CDATA[
      var scopedValue = Java.type("net.shibboleth.idp.attribute.ScopedStringAttributeValue");
      var digestUtils = Java.type("org.apache.commons.codec.digest.DigestUtils");
      var idSaltHash  = digestUtils.sha256Hex(%{idp.persistentId.sourceAttribute}.getValues().get(0) + "%{idp.persistentId.salt}");
      eduPersonUniqueId.addValue(new scopedValue(idSaltHash,"%{idp.scope}"));
    ]]></Script>
    <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.13" encodeType="false" />
    <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.13" friendlyName="eduPersonUniqueId" encodeType="false" />
  </AttributeDefinition>

  <!-- Re-assert ePUID as SAML SubjectID -->
  <AttributeDefinition id="SubjectID" xsi:type="Scoped" scope="%{idp.scope}" sourceAttributeID="eduPersonUniqueId">
    <Dependency ref="eduPersonUniqueId" />
    <DisplayName xml:lang="en">Opaque user identifier</DisplayName>
    <AttributeEncoder xsi:type="SAML1ScopedString" name="urn:oasis:names:tc:SAML:attribute:subject-id" encodeType="false" />
    <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oasis:names:tc:SAML:attribute:subject-id" friendlyName="SubjectID" encodeType="false" />
  </AttributeDefinition>

What are the plans wrt conf/saml-nameid.{properties,xml} going
forward, and the mechanisms to create for subject-id and for
pairwise-id from the IDP?
(At the IDP adding entries for subject-id and pairwise-id to both the
attribute-map.xml as well as the attribute-policy.xml (ScopingRules)
was trivial.)

I have not yet looked into creating pairwise-id as an attribute. I
guess it would look like the old ePTID attribute method plus a
ScopedString encoder, like the old "botched" targeted-id variant?

-peter