EduPersonTargetedId

[Cantor, Scott]

> What are the plans for the IDP to produce those identifiers easily?

Same code we use now, we can't deprecate it in the resolver since it's going to be needed. I was sort of hoping we'd dump pairwise as a concept, but that didn't happen.

> What are the plans wrt conf/saml-nameid.{properties,xml} going
> forward, and the mechanisms to create for subject-id and for
> pairwise-id from the IDP?

Not. That's for NameIDs only, which will always be the dominant approach with vendors.

> I have not yet looked into creating pairwise-id as an attribute. I
> guess it would look like the old ePTID attribute method plus a
> ScopedString encoder, like the old "botched" targeted-id variant?

Yep. It was a mistake to start with to ever abandon that but it didn't match the standard, which turned out to be a good thing and not a bad thing.

-- Scott