<html><head></head><body><div class="ydp32a359b8yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div><div>In our environment we are required to change our AD passwords every 6 weeks. It appears that when our users change their passwords it changes the value of eduPersonTargetedID. The SP calls it eptid and this is the data they gave us:</div><div><br></div><div><div>
<p class="ydpc6e7655cMsoNormal"><span style="font-family:Arial,sans-serif">eptid value on
2019-03-12: nRDymCKsSIoc5pbKdmm72swbqzQ=</span></p>
<p class="ydpc6e7655cMsoNormal"><span style="font-family:Arial,sans-serif">eptid value on
2019-05-06: w/yKZiuBopKxX6iCO1Pza3BuUbw=</span></p>
</div><div><br></div><div>Since eduPersonTargetedID is a triple tuple the above isn't the entire thing, but I'm expecting that it's just the third tuple we're seeing here and that's the part that's changing.</div><div><br></div><div>Regards</div><div>-Bob<br></div></div><div><br></div><div class="ydp32a359b8signature"><div>--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div></div>
<div><br></div><div><br></div>
</div><div id="yahoo_quoted_7571360150" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Tuesday, May 7, 2019, 12:34:16 PM EDT, Ray Bon <rbon@uvic.ca> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="yiv1027581269"><div>
<div>Are we really talking about a password change being coordinated with the change of another attribute?</div>
<div>Or is the user just updating their info (and password happens to be one of the items) and the chosen sourceAttribute is not really that persistent?</div>
<div><br clear="none">
</div>
<div>Ray</div>
<div><br clear="none">
</div>
<div class="yiv1027581269yqt4271899800" id="yiv1027581269yqt77618"><div>On Tue, 2019-05-07 at 16:13 +0000, Yeargan, Yancey wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex;border-left:2px #729fcf solid;padding-left:1ex;">
Take a look at the conf/saml-nameid.properties file, specifically the property "idp.persistentId.sourceAttribute". If that AD attribute changes as a result of a password change, then the value of eduPersonTargetedID will also change.
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269">--</div>
<div class="yiv1027581269">Yancey Yeargan</div>
<div class="yiv1027581269">University of North Texas System</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
<div class="yiv1027581269">
<div><br class="yiv1027581269" clear="none">
<blockquote type="cite" style="margin:0 0 0 .8ex;border-left:2px #729fcf solid;padding-left:1ex;">
<div class="yiv1027581269">On May 7, 2019, at 10:56 AM, Robert Lamothe <<a rel="nofollow" shape="rect" class="yiv1027581269" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>> wrote:</div>
<br class="yiv1027581269Apple-interchange-newline" clear="none">
<div class="yiv1027581269">
<div class="yiv1027581269">
<div class="yiv1027581269ydp5bceb085yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;">
<div class="yiv1027581269">
<div class="yiv1027581269">Howdy,</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269"> For a few months I've had an SP complaining that they need to reset the accounts of our users on a periodic basis. We've been monitoring this for some time and have identified that after one of our users is forced to change their AD password
their account requires a reset.</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269"> We've further identified that when a user changes their AD password it changes their eduPersonTargetedID value. By resetting the account they clear the value set in eduPersonTargetedID and allows a new one to be set.</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269"> When I read up on this attribute I find that it's made up of a triple tuple, one of which is generated. It's also supposed to be persistent but it's persistence doesn't have to be lifetime.</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269"> Can anyone help me understand why this attribute might change after an AD password change?</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269">Thanks</div>
<div class="yiv1027581269">-Bob<br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269"><br class="yiv1027581269" clear="none">
</div>
<div class="yiv1027581269ydp5bceb085signature">
<div class="yiv1027581269">--<br class="yiv1027581269" clear="none">
Bob Lamothe<br class="yiv1027581269" clear="none">
<a rel="nofollow" shape="rect" class="yiv1027581269" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br class="yiv1027581269" clear="none">
KB1BOB<br class="yiv1027581269" clear="none">
603-918-6336<br class="yiv1027581269" clear="none">
<br class="yiv1027581269" clear="none">
</div>
</div>
</div>
</div>
</div>
-- <br class="yiv1027581269" clear="none">
For Consortium Member technical support, see <a rel="nofollow" shape="rect" class="yiv1027581269" target="_blank" href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0</a><br class="yiv1027581269" clear="none">
To unsubscribe from this list send an email to <a rel="nofollow" shape="rect" class="yiv1027581269" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="yiv1027581269" clear="none">
</div>
</div>
</blockquote></div>
<div><span>
</span><pre>-- <br clear="none"></pre>
<div>Ray Bon</div>
<div>Programmer Analyst</div>
<div>Development Services, University Systems</div>
<div>2507218831 | CLE 019 | rbon@uvic.ca</div>
</div>
</div></div><div class="yqt4271899800" id="yqt86267">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
</div>
</div></body></html>