<div dir="ltr">We use the computedID connector here & <div><br></div><div><table border="0" cellpadding="0" cellspacing="0" style="font-size:13px;color:rgb(51,51,51);clear:left;width:898px;line-height:1.2em!important;border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px!important;vertical-align:baseline!important;font-family:Consolas,'Bitstream Vera Sans Mono','Courier New',Courier,monospace!important;min-height:inherit!important;background:none!important">
<tbody style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background:none!important"><tr style="font-size:1em!important;line-height:1.2em!important;border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px!important;vertical-align:baseline!important;width:auto!important;min-height:inherit!important;background:none!important">
<td class="" style="width:898px;font-size:1em!important;line-height:1.2em!important;border:0px dashed!important;overflow:visible!important;border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;float:none!important;height:auto!important;outline:0px!important;padding:0px!important;vertical-align:baseline!important;font-family:Consolas,'Bitstream Vera Sans Mono','Courier New',Courier,monospace!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
<div class="" title="Hint: double-click to select code" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 0px 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;white-space:pre-wrap!important;background:none!important">
<div class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 1em 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
<code class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px!important;vertical-align:baseline!important;width:auto!important;font-family:Consolas,'Bitstream Vera Sans Mono','Courier New',Courier,monospace!important;font-size:1em!important;min-height:inherit!important;color:rgb(0,0,0)!important;background:none!important">echo -n </code><code class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px!important;vertical-align:baseline!important;width:auto!important;font-family:Consolas,'Bitstream Vera Sans Mono','Courier New',Courier,monospace!important;font-size:1em!important;min-height:inherit!important;color:rgb(0,51,102)!important;background:none!important">'<SP EntityID>!<NetID>!<Secret>'</code> <code class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px!important;vertical-align:baseline!important;width:auto!important;font-family:Consolas,'Bitstream Vera Sans Mono','Courier New',Courier,monospace!important;font-size:1em!important;min-height:inherit!important;color:rgb(0,0,0)!important;background:none!important">|openssl dgst -binary -sha1 |openssl base64</code></div>
<div class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 1em 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
<br></div><div class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 1em 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
is what we use when we have to build a rainbow table for a particular service. Before we go building said table though we do work with the service to get a narrow window for the suspicious activity and then use our audit logs to narrow down the list of users to just those who accessed the service during the window.</div>
<div class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 1em 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
<br></div><div class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 1em 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
Dave</div><div class="" style="border-top-left-radius:0px!important;border-top-right-radius:0px!important;border-bottom-right-radius:0px!important;border-bottom-left-radius:0px!important;border:0px!important;float:none!important;height:auto!important;line-height:1.2em!important;margin:0px!important;outline:0px!important;overflow:visible!important;padding:0px 1em 0px 0em!important;vertical-align:baseline!important;width:auto!important;font-size:1em!important;min-height:inherit!important;background-image:none!important;background-repeat:initial!important">
<br></div></div></td></tr></tbody></table></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 27, 2014 at 10:39 AM, Steve Glover <span dir="ltr"><<a href="mailto:steve.glover@ed.ac.uk" target="_blank">steve.glover@ed.ac.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On 27/05/14 15:56, Peter Schober wrote:<br>
<br>
>> Or am I missing something horribly obvious?<br>
<br>
</div>(clearly, I was)<br>
<div class=""><br>
> Not sure what you're saying, the aacli doesn't take ePTId as an<br>
> input. Are you suggesting to loop over all userids with the aacli?<br>
<br>
</div>I had been. I didn't consider the issues involved in scaling up from a<br>
test IdP with less than ten "users"<br>
<div class=""><br>
> That would work but I'm guessing will be /much/ slower than simply<br>
> finding and re-implementing the algorithm used in the generation of<br>
> the values and doing the looping outside of repeated JVM startups and<br>
> teardowns for every single subject.<br>
<br>
</div>Hadn't realised there was quite so much overhead - I just went to<br>
another screen and left the script running (once I'd found out about the<br>
whole missing servlet-api.jar thing and upgraded to 2.4.0).<br>
<br>
But yeah, on checking, running the aacli.sh script eight times took<br>
2m48s - scaling to any useful number of users to generate the epTID<br>
would be silly (that said, "simply finding and re-implementing the<br>
algorithm" would probably take me an even more ridiculous amount of time).<br>
<br>
It occurs to me that a tool to generate ePTIDs for all an IdP's users<br>
might be useful for just this sort of occasion<br>
<span class="HOEnZb"><font color="#888888"><br>
Steve<br>
</font></span><div class="im HOEnZb"><br>
<br>
<br>
> -peter<br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
><br>
<br>
<br>
</div><div class="im HOEnZb">--<br>
Steve Glover: SDSS, EDINA, Causewayside House, 160 Causewayside EH9 1PR<br>
<a href="mailto:e%3Asteve.glover@ed.ac.uk">e:steve.glover@ed.ac.uk</a> t:0131 650 2908 f:0131 650 3308 m:07961 446 902<br>
<br>
The University of Edinburgh is a charitable body, registered in<br>
Scotland, with registration number SC005336.<br>
</div><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div>
</div>