<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>Thank you.</span></div><div><br></div> <div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> "Cantor, Scott" <cantor.2@osu.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, September 26, 2012 6:55 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: eduPersonTargetedId question<br> </font> </div> <br>
On 9/26/12 9:39 AM, "Nate Klingenstein" <<a ymailto="mailto:ndk@internet2.edu" href="mailto:ndk@internet2.edu">ndk@internet2.edu</a>> wrote:<br>><br>>You're treating a string-like eduPersonTargetedID as a scoped<br>>eduPersonTargetedID. This is understandable given ample early confusion<br>>about how to express the concept behind eduPersonTargetedID and whether<br>>it should be scoped.<br>><br>><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID</a><br><br>Yes, but what he's receiving is not only botched but wrong and dangerous.<br>It's an unqualified identifier that doesn't meet the criteria of simple<br>uniqueness. Do NOT accept it. The SP is protecting you; let it.<br><br>>The most expedient fix in your case would be to change the attribute<br>>decoder to a simple attribute decoder, and edit
attribute-filter.xml to<br>>remove the scoping check.<br><br>Definitely do not do that. If what you were getting was an improperly<br>expressed botched attribute value with a scope, you can use the<br>NameIDFromScoped Attribute Decoder to normalize the value into the same<br>form as correctly asserted SAML persisent IDs. But you can't do that with<br>this one.<br><br>-- Scott<br><br><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br> </div> </div> </div></body></html>