PersistentNameIDGenerationConfiguration: Type 4 UUID

[Hugo Slavia]

Thanks All --- that makes sense (Duh -- I missed reading the docs on this
-- apologies).

The subsequent PERSISTENTID for the tuple are UUID :)

I have set the following (by un-commenting 'idp.persistentId.computed' and
setting to empty value) --- however the 1st PERSISTENTID value is still
hash (new account --- never user before) --- did I miss something else
(IdPv3.3.3).

# Set to an empty property to skip hash-based generation of first stored ID
idp.persistentId.computed =
#idp.persistentId.generator = shibboleth.StoredPersistentIdGenerator
idp.persistentId.dataSource = OracleDataSource
idp.persistentId.sourceAttribute = uid
idp.persistentId.salt = foobar+
#idp.persistentId.store = OracleDataSource

On Wed, Jan 24, 2018 at 6:42 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/24/18, 8:47 AM, "users on behalf of Peter Schober" <
> users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at>
> wrote:
>
> > Not sure where that config setting went (if it ever existed) but
> > that's what you'd set for newly created NameIDs.
>
> Last property in saml-nameid.properties:
>
> # Set to an empty property to skip hash-based generation of first stored ID
> #idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator
>
> Literally set it to an empty value.
>
> idp.persistentId.computed =
>
> Or use the resolver data connectors as before of course if preferred.
>
> The real reason to do this, if you really insist on it, is the base64
> thing. Those IDs are unsafe. But you still need to take care doing this and
> work with every SP that's received the old values, and most/many probably
> don't have a way to work with you on that.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180124/338f3d84/attachment.html>