<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Take a look at the conf/saml-nameid.properties file, specifically the property "idp.persistentId.sourceAttribute". If that AD attribute changes as a result of a password change, then the value of eduPersonTargetedID will also change.
<div class=""><br class="">
</div>
<div class="">--</div>
<div class="">Yancey Yeargan</div>
<div class="">University of North Texas System</div>
<div class=""><br class="">
<div class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On May 7, 2019, at 10:56 AM, Robert Lamothe <<a href="mailto:robert_lamothe@yahoo.com" class="">robert_lamothe@yahoo.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<div class="ydp5bceb085yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;">
<div class="">
<div class="">Howdy,</div>
<div class=""><br class="">
</div>
<div class=""> For a few months I've had an SP complaining that they need to reset the accounts of our users on a periodic basis. We've been monitoring this for some time and have identified that after one of our users is forced to change their AD password
their account requires a reset.</div>
<div class=""><br class="">
</div>
<div class=""> We've further identified that when a user changes their AD password it changes their eduPersonTargetedID value. By resetting the account they clear the value set in eduPersonTargetedID and allows a new one to be set.</div>
<div class=""><br class="">
</div>
<div class=""> When I read up on this attribute I find that it's made up of a triple tuple, one of which is generated. It's also supposed to be persistent but it's persistence doesn't have to be lifetime.</div>
<div class=""><br class="">
</div>
<div class=""> Can anyone help me understand why this attribute might change after an AD password change?</div>
<div class=""><br class="">
</div>
<div class="">Thanks</div>
<div class="">-Bob<br class="">
</div>
<div class=""><br class="">
</div>
<div class="ydp5bceb085signature">
<div class="">--<br class="">
Bob Lamothe<br class="">
<a href="mailto:robert_lamothe@yahoo.com" class="">robert_lamothe@yahoo.com</a><br class="">
KB1BOB<br class="">
603-918-6336<br class="">
<br class="">
</div>
</div>
</div>
</div>
</div>
-- <br class="">
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0" class="">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>