legacy eduPersonTargetedID attribute definition

[Andrew Jason Morgan]

I'm updating my IDP configuration after upgrading from v4.0.1 to v4.1.4, and one of the deprecation warnings is:

WARN [DEPRECATED:125] - xsi:type 'SAML2NameID', (file [/opt/shibboleth-idp/conf/attribute-resolver.xml]): This will be removed in the next major version of this software; replacement is (none)

It took me a while to find that this was actually deprecated in v3!  Shame on me...  Here is the attribute definition:

    <AttributeDefinition xsi:type="SAML2NameID" id="eduPersonTargetedID" nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
        <InputDataConnector ref="computedID" attributeNames="computedID" />
        <AttributeEncoder xsi:type="SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" />
    </AttributeDefinition>
    <DataConnector xsi:type="ComputedId"
                            id="computedID"
                            generatedAttributeID="computedID"
                            salt="%{idp.persistentId.salt}">
        <InputDataConnector ref="ONIDLDAP" attributeNames="osuUID" />
    </DataConnector>

I don't think there is any way this is actually being used as a NameID because there is no reference to it in saml-nameid.xml and saml-nameid.properties contains:

# For computed IDs, set a source attribute, and a secret salt in secrets.properties
idp.persistentId.sourceAttribute = osuuid
idp.persistentId.useUnfilteredAttributes = true
#idp.persistentId.algorithm = SHA
# BASE64 will match V2 values, we recommend BASE32 encoding for new installs.
idp.persistentId.encoding = BASE64

Unfortunately, we are still releasing it as an attribute, so I can't just delete it.  How do I keep the same encoding for the attribute and get rid of SAML2NameID?  I'm not ready to use the attribute registry yet.

Thanks,
Andy

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220201/65e28154/attachment.htm>