Resurrection: eduPersonTargettedId (Shibboleth v2)

[Losen, Stephen C (scl)]

Hi Joshua,

I am pretty sure this is the algorithm that generates computed ID:

base64_encode(SHA1_digest(sp_entityID + “!” + uid + “!” + salt))

Or if you are running a v3 IDP you can define a computedID attribute (be sure to use base64 instead of base32) with the correct salt and then define a SP with the correct entityID to release it to, and use bin/aacli.sh to display the assertion, which will include the computedID.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu<mailto:scl at virginia.edu>    434-924-0640

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Joshua Brodie
Sent: Wednesday, January 23, 2019 10:12 PM
To: users <users at shibboleth.net>
Subject: Resurrection: eduPersonTargettedId (Shibboleth v2)

Blast from the past. We have a long forgotten SP that wishes to find out users on our deprecated v2 Shibboleth.

They used the legacy eduPersonTargetedID in Shib2 -- and have stored the values for users.

We know who have access the SP by their uid from the logs.

What I am not sure is how to generate the targetedtId from the uid (outside of the long gone v2 instance)? Desired outcome: we sent the list of uid/eduPersonTargetedId mapping to the SP -- that they can find out who used their site (for a security follow-up).

The following is how we had configured the generation of the sent value (I have the salt).


<resolver:DataConnector id="mystoredhashedid" xsi:type="ComputedId" xmlns="urn:mace:shibboleth:2.0:resolver:dc"

                    generatedAttributeID="targetedID"

                    sourceAttributeID="uid"

                    salt="foobar">



                    <resolver:Dependency ref="dbmain" />



          </resolver:DataConnector>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190124/f6b62e95/attachment.html>