Resurrection: eduPersonTargettedId (Shibboleth v2)

[Peter Schober]

* Joshua Brodie <josbrodie at gmail.com> [2019-01-24 04:13]:
> The following is how we had configured the generation of the sent
> value (I have the salt).
> 
> <resolver:DataConnector id="mystoredhashedid" xsi:type="ComputedId" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
>     generatedAttributeID="targetedID"
>     sourceAttributeID="uid"
>     salt="foobar">
>     <resolver:Dependency ref="dbmain" />
> </resolver:DataConnector>

All you'd need to do is translate that to v3 syntax, maybe something
like this (with the property 'idp.persistentId.salt' being set in
saml-nameid.properties preferrably):

  <DataConnector id="mystoredhashedid" xsi:type="ComputedId"
    generatedAttributeID="targetedID"
    salt="%{idp.persistentId.salt}"
    algorithm="SHA"
    encoding="BASE64">
    <InputDataConnector ref="dbmain" attributeNames="uid" />
  </DataConnector>

And the AttributeDefinition using that would look something like this:

  <AttributeDefinition id="eduPersonTargetedID" xsi:type="SAML2NameID" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
    <InputDataConnector ref="mystoredhashedid" attributeNames="targetedID" />
    <AttributeEncoder xsi:type="SAML1XMLObject"	name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" encodeType="false" />
    <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" encodeType="false" />
  </AttributeDefinition>

The documentation should cover all of that.

You can test the above on the command line for arbitrary userids using
the aacli with the '--saml2' argument and compare known values from
your old system.

-peter