PersistentNameIDGenerationConfiguration: Type 4 UUID

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2018-01-24 13:03]:
> The IDP already generates them that way (type 4 UUIDs) *if* they are
> not the first value for a given principal and relying party.
[...]
> *But* the resulting NameID string value is /not/ a type4 UUID
> itself, because those would be random (as per the spec), whereas a
> NameID string value is produced from hashing it together with a
> salt and with the name qualifiers.

Forget that latter part, that's describing the old way of generating
and persisting the NameID string values. In fact the values (for
non-first generation) are version 4 UUIDs (of whatever variant 'b'
means).

Not sure where that config setting went (if it ever existed) but
that's what you'd set for newly created NameIDs. And if you want to
make your management happy and annoying your users (and IT support
colleagues) you'd just have to insert a deactivationDate into the
shibpid table for everyone to get new version 4 UUID-valued NameIDs
assigned, breaking all kinds of applications everywhere.

-peter