<html><head></head><body><div class="ydpfdf19025yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div><div>Yes, I recognize that, one of the things I find odd, is I used SAMLtest.id back in March to see how the tuple was being built and on my ID the hash is <span>65ouMPe2cDV5ovCHfiCzbqhHG7A. I did the same today and even though I changed my pw last week I'm getting the same hash which confuses me as to why it's not happening for me, but for others.</span></div><div><span><br></span></div><div><span>How do I figure out where this hash is being generated? <br></span></div><div><span><br></span></div><div><span>My resolver definition is:</span></div><div><span><br></span></div><div><span></span><div><resolver:AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID"<br> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID"><br> <resolver:Dependency ref="computedID" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" /><br></resolver:AttributeDefinition><br><br></div><div>In it I see sourceAttributeID as computeID, when I read the shibboleth page on Computed it refers to a number of properties all of which appear to be commented out in my <span>saml-nameid.properties. <br></span></div><div><span><br></span></div><div><span>I could enable them, but I don't know what to use for <span><strong>idp.persistentId.sourceAttribute</strong></span>, it reads as if this should be an attribute that contains a unique number associated with each user but not GUID. I'm not sure what I could use for this that would be private information like employee ID ro something like that.</span></div><div><span><br></span></div><div><span>Thanks</span></div><div><span>-Bob<br></span></div></div><div><br></div><div class="ydpfdf19025signature"><div>--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div></div>
<div><br></div><div><br></div>
</div><div id="yahoo_quoted_8056340887" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Tuesday, May 7, 2019, 12:57:30 PM EDT, Yeargan, Yancey <Yancey.Yeargan@untsystem.edu> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="yiv3756576947"><div>
It starts with a triple tuple (one component of which comes from AD), but the tuple is then hashed with the salt value. What you're seeing as the "eptid" is the final calculated hash value.
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">You will need to find out how your server is generating those values. It's in the attribute resolver configuration, or possibly the NameID configuration, depending on how you are sending it to the application.</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">--</div>
<div class="yiv3756576947">Yancey Yeargan</div>
<div class="yiv3756576947">University of North Texas System<br class="yiv3756576947" clear="none">
<div><br class="yiv3756576947" clear="none">
</div>
<div><br class="yiv3756576947" clear="none">
</div>
<div><br class="yiv3756576947" clear="none">
<blockquote class="yiv3756576947" type="cite">
<div class="yiv3756576947yqt1628458211" id="yiv3756576947yqt78707"><div class="yiv3756576947">On May 7, 2019, at 11:39 AM, Robert Lamothe <<a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>> wrote:</div>
<br class="yiv3756576947Apple-interchange-newline" clear="none">
<div class="yiv3756576947">
<div class="yiv3756576947">
<div class="yiv3756576947ydp32a359b8yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;">
<div class="yiv3756576947">
<div class="yiv3756576947">In our environment we are required to change our AD passwords every 6 weeks. It appears that when our users change their passwords it changes the value of eduPersonTargetedID. The SP calls it eptid and this is the data they gave us:</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">
<div class="yiv3756576947">
<p class="yiv3756576947ydpc6e7655cMsoNormal"><span class="yiv3756576947" style="font-family:Arial, sans-serif;">eptid value on 2019-03-12: nRDymCKsSIoc5pbKdmm72swbqzQ=</span></p>
<p class="yiv3756576947ydpc6e7655cMsoNormal"><span class="yiv3756576947" style="font-family:Arial, sans-serif;">eptid value on 2019-05-06: w/yKZiuBopKxX6iCO1Pza3BuUbw=</span></p>
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">Since eduPersonTargetedID is a triple tuple the above isn't the entire thing, but I'm expecting that it's just the third tuple we're seeing here and that's the part that's changing.</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">Regards</div>
<div class="yiv3756576947">-Bob<br class="yiv3756576947" clear="none">
</div>
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947ydp32a359b8signature">
<div class="yiv3756576947">--<br class="yiv3756576947" clear="none">
Bob Lamothe<br class="yiv3756576947" clear="none">
<a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br class="yiv3756576947" clear="none">
KB1BOB<br class="yiv3756576947" clear="none">
603-918-6336<br class="yiv3756576947" clear="none">
<br class="yiv3756576947" clear="none">
</div>
</div>
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
</div>
<div class="yiv3756576947yahoo_quoted" id="yiv3756576947yahoo_quoted_7571360150">
<div class="yiv3756576947" style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div class="yiv3756576947">On Tuesday, May 7, 2019, 12:34:16 PM EDT, Ray Bon <<a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:rbon@uvic.ca" target="_blank" href="mailto:rbon@uvic.ca">rbon@uvic.ca</a>> wrote:
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">
<div class="yiv3756576947" id="yiv3756576947">
<div class="yiv3756576947">
<div class="yiv3756576947">Are we really talking about a password change being coordinated with the change of another attribute?</div>
<div class="yiv3756576947">Or is the user just updating their info (and password happens to be one of the items) and the chosen sourceAttribute is not really that persistent?</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">Ray</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947yqt4271899800" id="yiv3756576947yqt77618">
<div class="yiv3756576947">On Tue, 2019-05-07 at 16:13 +0000, Yeargan, Yancey wrote:</div>
<blockquote class="yiv3756576947" type="cite" style="margin:0 0 0 .8ex;border-left:2px #729fcf solid;padding-left:1ex;">
Take a look at the conf/saml-nameid.properties file, specifically the property "idp.persistentId.sourceAttribute". If that AD attribute changes as a result of a password change, then the value of eduPersonTargetedID will also change.
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">--</div>
<div class="yiv3756576947">Yancey Yeargan</div>
<div class="yiv3756576947">University of North Texas System</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
<div class="yiv3756576947">
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
<blockquote class="yiv3756576947" type="cite" style="margin:0 0 0 .8ex;border-left:2px #729fcf solid;padding-left:1ex;">
<div class="yiv3756576947">On May 7, 2019, at 10:56 AM, Robert Lamothe <<a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>> wrote:</div>
<br class="yiv3756576947Apple-interchange-newline" clear="none">
<div class="yiv3756576947">
<div class="yiv3756576947">
<div class="yiv3756576947ydp5bceb085yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;">
<div class="yiv3756576947">
<div class="yiv3756576947">Howdy,</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"> For a few months I've had an SP complaining that they need to reset the accounts of our users on a periodic basis. We've been monitoring this for some time and have identified that after one of our users is forced to change their
AD password their account requires a reset.</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"> We've further identified that when a user changes their AD password it changes their eduPersonTargetedID value. By resetting the account they clear the value set in eduPersonTargetedID and allows a new one to be set.</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"> When I read up on this attribute I find that it's made up of a triple tuple, one of which is generated. It's also supposed to be persistent but it's persistence doesn't have to be lifetime.</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"> Can anyone help me understand why this attribute might change after an AD password change?</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947">Thanks</div>
<div class="yiv3756576947">-Bob<br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947"><br class="yiv3756576947" clear="none">
</div>
<div class="yiv3756576947ydp5bceb085signature">
<div class="yiv3756576947">--<br class="yiv3756576947" clear="none">
Bob Lamothe<br class="yiv3756576947" clear="none">
<a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br class="yiv3756576947" clear="none">
KB1BOB<br class="yiv3756576947" clear="none">
603-918-6336<br class="yiv3756576947" clear="none">
<br class="yiv3756576947" clear="none">
</div>
</div>
</div>
</div>
</div>
-- <br class="yiv3756576947" clear="none">
For Consortium Member technical support, see <a rel="nofollow" shape="rect" class="yiv3756576947" target="_blank" href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cacc1f95d3f0b4e6a03b608d6d30a9db3%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928439875355172&sdata=TnyFxn3cwTE5xLtIi5mxsG1%2B4HW%2Bca8Ee%2FfeWU5SRNQ%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0</a><br class="yiv3756576947" clear="none">
To unsubscribe from this list send an email to <a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="yiv3756576947" clear="none">
</div>
</div>
</blockquote>
</div>
<div class="yiv3756576947"><span class="yiv3756576947"></span>
<pre class="yiv3756576947">-- <br class="yiv3756576947" clear="none"></pre>
<div class="yiv3756576947">Ray Bon</div>
<div class="yiv3756576947">Programmer Analyst</div>
<div class="yiv3756576947">Development Services, University Systems</div>
<div class="yiv3756576947">2507218831 | CLE 019 | <a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:rbon@uvic.ca" target="_blank" href="mailto:rbon@uvic.ca">rbon@uvic.ca</a></div>
</div>
</div>
</div>
<div class="yiv3756576947yqt4271899800" id="yiv3756576947yqt86267">-- <br class="yiv3756576947" clear="none">
For Consortium Member technical support, see <a rel="nofollow" shape="rect" class="yiv3756576947" target="_blank" href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cacc1f95d3f0b4e6a03b608d6d30a9db3%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928439875365181&sdata=ZWEv%2F%2B0lXblkEiD%2FVBj3NsuhNuZsPe%2Ba0%2BfMdFzmmPg%3D&reserved=0">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="yiv3756576947" clear="none">
To unsubscribe from this list send an email to <a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div>
</div>
</div>
</div>
</div>
-- <br class="yiv3756576947" clear="none">
For Consortium Member technical support, see <a rel="nofollow" shape="rect" class="yiv3756576947" target="_blank" href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cacc1f95d3f0b4e6a03b608d6d30a9db3%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928439875375185&sdata=aUn%2BHlHYlG1JHCpGc9ZgNT7ZAzmHAoYekV7ZnS30srg%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cacc1f95d3f0b4e6a03b608d6d30a9db3%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928439875375185&sdata=aUn%2BHlHYlG1JHCpGc9ZgNT7ZAzmHAoYekV7ZnS30srg%3D&reserved=0</a><br class="yiv3756576947" clear="none">
To unsubscribe from this list send an email to <a rel="nofollow" shape="rect" class="yiv3756576947" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div></div>
</blockquote>
</div>
<br class="yiv3756576947" clear="none">
</div>
</div></div><div class="yqt1628458211" id="yqt11406">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
</div>
</div></body></html>