<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Monaco;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.gmail-m-6256108361471204987gmail-p1, li.gmail-m-6256108361471204987gmail-p1, div.gmail-m-6256108361471204987gmail-p1
{mso-style-name:gmail-m_-6256108361471204987gmail-p1;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.gmail-m-6256108361471204987gmail-s1
{mso-style-name:gmail-m_-6256108361471204987gmail-s1;}
span.gmail-m-6256108361471204987gmail-s2
{mso-style-name:gmail-m_-6256108361471204987gmail-s2;}
span.gmail-m-6256108361471204987gmail-s3
{mso-style-name:gmail-m_-6256108361471204987gmail-s3;}
span.gmail-m-6256108361471204987gmail-s4
{mso-style-name:gmail-m_-6256108361471204987gmail-s4;}
p.gmail-m-6256108361471204987gmail-p2, li.gmail-m-6256108361471204987gmail-p2, div.gmail-m-6256108361471204987gmail-p2
{mso-style-name:gmail-m_-6256108361471204987gmail-p2;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.gmail-m-6256108361471204987gmail-apple-converted-space
{mso-style-name:gmail-m_-6256108361471204987gmail-apple-converted-space;}
span.gmail-m-6256108361471204987gmail-s5
{mso-style-name:gmail-m_-6256108361471204987gmail-s5;}
p.gmail-m-6256108361471204987gmail-p3, li.gmail-m-6256108361471204987gmail-p3, div.gmail-m-6256108361471204987gmail-p3
{mso-style-name:gmail-m_-6256108361471204987gmail-p3;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.gmail-m-6256108361471204987gmail-p4, li.gmail-m-6256108361471204987gmail-p4, div.gmail-m-6256108361471204987gmail-p4
{mso-style-name:gmail-m_-6256108361471204987gmail-p4;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle27
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Joshua,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">SHA1 is a one way hash, so the only way to go from targetedID to uid is to feed likely candidate uids to the algorithm and see if any result matches the targetedID.
It would not take terribly long to feed say 100,000 uids to the algorithm on today’s fast CPUs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Stephen C. Losen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS - Systems and Storage<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:scl@virginia.edu"><span style="color:#0563C1">scl@virginia.edu</span></a> 434-924-0640<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Joshua Brodie<br>
<b>Sent:</b> Friday, January 25, 2019 4:29 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Resurrection: eduPersonTargettedId (Shibboleth v2)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I was very optimistic earlier - that we had the logs from who has accessed the service (beyond the retention policies).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If provided with the eduPersonTargetedId value by the SP (and I know the hash) -- is it possible to reverse to the original seed value?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">We are not going to migrate this legacy SP, that was on the deprecated v2 IDP, to the v3 IDP. It's a security follow-up that I can't go to in detail.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, 24 Jan 2019 at 02:46, Losen, Stephen C (scl) <<a href="mailto:scl@virginia.edu">scl@virginia.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Joshua,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I am pretty sure this is the algorithm that generates computed ID:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">base64_encode(SHA1_digest(sp_entityID + “!” + uid + “!” + salt))</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Or if you are running a v3 IDP you can define a computedID attribute (be sure to use base64 instead
of base32) with the correct salt and then define a SP with the correct entityID to release it to, and use bin/aacli.sh to display the assertion, which will include the computedID.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Stephen C. Losen</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS - Systems and Storage</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:scl@virginia.edu" target="_blank">scl@virginia.edu</a> 434-924-0640</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Joshua Brodie<br>
<b>Sent:</b> Wednesday, January 23, 2019 10:12 PM<br>
<b>To:</b> users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Resurrection: eduPersonTargettedId (Shibboleth v2)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Blast from the past. We have a long forgotten SP that wishes to find out users on our deprecated v2 Shibboleth.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">They used the legacy eduPersonTargetedID in Shib2 -- and have stored the values for users.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We know who have access the SP by their uid from the logs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">What I am not sure is how to generate the targetedtId from the uid (outside of the long gone v2 instance)? Desired outcome: we sent the list of uid/eduPersonTargetedId mapping to
the SP -- that they can find out who used their site (for a security follow-up).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The following is how we had configured the generation of the sent value (I have the salt).<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="gmail-m-6256108361471204987gmail-p1" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:teal"><</span></span><span class="gmail-m-6256108361471204987gmail-s2"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#3F7F7F">resolver:DataConnector</span></span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">
</span></span><span class="gmail-m-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#7F007F">id</span></span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#2A00FF">"mystoredhashedid"</span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">
</span></span><span class="gmail-m-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#7F007F">xsi:type</span></span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#2A00FF">"ComputedId"</span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">
</span></span><span class="gmail-m-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#7F007F">xmlns</span></span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#2A00FF">"urn:mace:shibboleth:2.0:resolver:dc"</span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p2" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif">
</span></span><span class="gmail-m-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#7F007F">generatedAttributeID</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif">=<span class="gmail-m-6256108361471204987gmail-s5"><span style="color:#2A00FF">"targetedID"</span></span></span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p2" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif">
</span></span><span class="gmail-m-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#7F007F">sourceAttributeID</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif">=<span class="gmail-m-6256108361471204987gmail-s5"><span style="color:#2A00FF">"uid"</span></span></span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p1" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">
</span></span><span class="gmail-m-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#7F007F">salt</span></span><span class="gmail-m-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#2A00FF">"foobar"</span><span class="gmail-m-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:teal">></span></span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p3" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;min-height:15px">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif"> </span></span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p2" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif">
</span></span><span class="gmail-m-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:teal"><</span></span><span class="gmail-m-6256108361471204987gmail-s2"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#3F7F7F">resolver:Dependency</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif">
<span class="gmail-m-6256108361471204987gmail-s4"><span style="color:#7F007F">ref</span></span>=<span class="gmail-m-6256108361471204987gmail-s5"><span style="color:#2A00FF">"dbmain"</span></span>
<span class="gmail-m-6256108361471204987gmail-s1"><span style="color:teal">/></span></span></span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p3" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;min-height:15px">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif"> </span></span><o:p></o:p></p>
<p class="gmail-m-6256108361471204987gmail-p4" style="margin:0in;margin-bottom:.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:black">
</span></span><span class="gmail-m-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:teal"></</span></span><span style="font-size:8.5pt;font-family:"Monaco",serif;color:#3F7F7F">resolver:DataConnector</span><span class="gmail-m-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:"Monaco",serif;color:teal">></span></span><o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal">-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>