aacli

[Christopher Bongaarts]

On 2/8/2021 11:59 AM, Donald Lohr wrote:
> When using the aacli tool, the top line of the results is:
>
> <?xml version="1.0" encoding="UTF-8"?><saml2:Assertion 
> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="*_Removed the 
> returned value*" IssueInstant="2021-02-08T17:22:29.862Z" Version="2.0">
>
> My question is about the ID value. I've removed the actual ID returned 
> (from above) when I ran the aacli tool. But its value is different for 
> each user for the same SP and different for each SP. The returned ID 
> values are 31 characters starting with an underscore and then 
> alpha-numeric.
>
> Not sure what to search on in the Shibboleth wiki to even find what 
> these values mean and what they are for.
>
> Thanks, if anyone could point me to said documents.

It's a SAMLism, not specific to Shib/AACLI:

https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf 
<https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf>

    1.3.4 ID and ID Reference Values

    The xs:IDsimple type is used to declare SAML identifiers for
    assertions, requests,and responses. Valuesdeclared to be oftype
    xs:IDin this specification MUST satisfy the following propertiesin
    addition to thoseimposed by the definition of the xs:IDtype itself:

    •Any party that assignsan identifier MUST ensure that there is
    negligible probability that that party or any other party will
    accidentally assign the same identifier to a different data object.

    •Where a data object declaresthat it has a particular identifier,
    there MUSTbe exactly one such declaration.

    The mechanism by which a SAML system entity ensures that the
    identifier is unique is left to the implementation. In the case that
    a random or pseudorandomtechnique is employed, the probability of
    two randomly chosen identifiers being identical MUSTbe less than or
    equal to 2-128and SHOULDbe less than or equal to 2-160. This
    requirement MAY be met by encoding a randomly chosen value between
    128 and 160 bits in length. The encodingmust conform to the rules
    defining the xs:IDdatatype.A pseudorandomgenerator MUST be seeded
    with unique material in order to ensure the desired
    uniquenesspropertiesbetween different systems.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210208/deabfb00/attachment.htm>