<div dir="ltr">Thanks!<div><br></div><div>I was very optimistic earlier - that we had the logs from who has accessed the service (beyond the retention policies).</div><div><br></div><div>If provided with the eduPersonTargetedId value by the SP (and I know the hash) -- is it possible to reverse to the original seed value?</div><div><br></div><div>We are not going to migrate this legacy SP, that was on the deprecated v2 IDP, to the v3 IDP. It's a security follow-up that I can't go to in detail.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, 24 Jan 2019 at 02:46, Losen, Stephen C (scl) <<a href="mailto:scl@virginia.edu">scl@virginia.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-6256108361471204987WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Hi Joshua,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">I am pretty sure this is the algorithm that generates computed ID:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">base64_encode(SHA1_digest(sp_entityID + “!” + uid + “!” + salt))<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Or if you are running a v3 IDP you can define a computedID attribute (be sure to use base64 instead of base32) with the correct salt and then define a SP with
the correct entityID to release it to, and use bin/aacli.sh to display the assertion, which will include the computedID.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Stephen C. Losen<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">ITS - Systems and Storage<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">University of Virginia<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><a href="mailto:scl@virginia.edu" target="_blank">scl@virginia.edu</a> 434-924-0640<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> users [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Joshua Brodie<br>
<b>Sent:</b> Wednesday, January 23, 2019 10:12 PM<br>
<b>To:</b> users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Resurrection: eduPersonTargettedId (Shibboleth v2)<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Blast from the past. We have a long forgotten SP that wishes to find out users on our deprecated v2 Shibboleth.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">They used the legacy eduPersonTargetedID in Shib2 -- and have stored the values for users.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We know who have access the SP by their uid from the logs.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">What I am not sure is how to generate the targetedtId from the uid (outside of the long gone v2 instance)? Desired outcome: we sent the list of uid/eduPersonTargetedId mapping to the SP -- that they can find out who used their site (for
a security follow-up).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">The following is how we had configured the generation of the sent value (I have the salt).<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="gmail-m_-6256108361471204987gmail-p1" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:Monaco,serif;color:teal"><</span></span><span class="gmail-m_-6256108361471204987gmail-s2"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(63,127,127)">resolver:DataConnector</span></span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">
</span></span><span class="gmail-m_-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(127,0,127)">id</span></span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(42,0,255)">"mystoredhashedid"</span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">
</span></span><span class="gmail-m_-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(127,0,127)">xsi:type</span></span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(42,0,255)">"ComputedId"</span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">
</span></span><span class="gmail-m_-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(127,0,127)">xmlns</span></span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(42,0,255)">"urn:mace:shibboleth:2.0:resolver:dc"<u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p2" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif">
</span></span><span class="gmail-m_-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(127,0,127)">generatedAttributeID</span></span><span style="font-size:8.5pt;font-family:Monaco,serif">=<span class="gmail-m_-6256108361471204987gmail-s5"><span style="color:rgb(42,0,255)">"targetedID"</span></span><u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p2" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif">
</span></span><span class="gmail-m_-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(127,0,127)">sourceAttributeID</span></span><span style="font-size:8.5pt;font-family:Monaco,serif">=<span class="gmail-m_-6256108361471204987gmail-s5"><span style="color:rgb(42,0,255)">"uid"</span></span><u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p1" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">
</span></span><span class="gmail-m_-6256108361471204987gmail-s4"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(127,0,127)">salt</span></span><span class="gmail-m_-6256108361471204987gmail-s3"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">=</span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(42,0,255)">"foobar"</span><span class="gmail-m_-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:Monaco,serif;color:teal">></span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(42,0,255)"><u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p3" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;min-height:15px">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif"> </span></span><span style="font-size:8.5pt;font-family:Monaco,serif"><u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p2" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif">
</span></span><span class="gmail-m_-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:Monaco,serif;color:teal"><</span></span><span class="gmail-m_-6256108361471204987gmail-s2"><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(63,127,127)">resolver:Dependency</span></span><span style="font-size:8.5pt;font-family:Monaco,serif">
<span class="gmail-m_-6256108361471204987gmail-s4"><span style="color:rgb(127,0,127)">ref</span></span>=<span class="gmail-m_-6256108361471204987gmail-s5"><span style="color:rgb(42,0,255)">"dbmain"</span></span>
<span class="gmail-m_-6256108361471204987gmail-s1"><span style="color:teal">/></span></span><u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p3" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;min-height:15px">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif"> </span></span><span style="font-size:8.5pt;font-family:Monaco,serif"><u></u><u></u></span></p>
<p class="gmail-m_-6256108361471204987gmail-p4" style="margin:0in 0in 0.0001pt;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal">
<span class="gmail-m_-6256108361471204987gmail-apple-converted-space"><span style="font-size:8.5pt;font-family:Monaco,serif;color:black">
</span></span><span class="gmail-m_-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:Monaco,serif;color:teal"></</span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(63,127,127)">resolver:DataConnector</span><span class="gmail-m_-6256108361471204987gmail-s1"><span style="font-size:8.5pt;font-family:Monaco,serif;color:teal">></span></span><span style="font-size:8.5pt;font-family:Monaco,serif;color:rgb(63,127,127)"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>