PersistentNameIDGenerationConfiguration: Type 4 UUID

[Cantor, Scott]

On 1/24/18, 8:47 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:

> Not sure where that config setting went (if it ever existed) but
> that's what you'd set for newly created NameIDs.

Last property in saml-nameid.properties:

# Set to an empty property to skip hash-based generation of first stored ID
#idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator

Literally set it to an empty value.

idp.persistentId.computed = 

Or use the resolver data connectors as before of course if preferred.

The real reason to do this, if you really insist on it, is the base64 thing. Those IDs are unsafe. But you still need to take care doing this and work with every SP that's received the old values, and most/many probably don't have a way to work with you on that.

-- Scott