<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body class="" style="text-align:left; direction:ltr;">
<div>Are we really talking about a password change being coordinated with the change of another attribute?</div>
<div>Or is the user just updating their info (and password happens to be one of the items) and the chosen sourceAttribute is not really that persistent?</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Tue, 2019-05-07 at 16:13 +0000, Yeargan, Yancey wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
Take a look at the conf/saml-nameid.properties file, specifically the property "idp.persistentId.sourceAttribute". If that AD attribute changes as a result of a password change, then the value of eduPersonTargetedID will also change.
<div class=""><br class="">
</div>
<div class="">--</div>
<div class="">Yancey Yeargan</div>
<div class="">University of North Texas System</div>
<div class=""><br class="">
<div class="">
<div><br class="">
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div class="">On May 7, 2019, at 10:56 AM, Robert Lamothe <<a href="mailto:robert_lamothe@yahoo.com" class="">robert_lamothe@yahoo.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<div class="ydp5bceb085yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;">
<div class="">
<div class="">Howdy,</div>
<div class=""><br class="">
</div>
<div class=""> For a few months I've had an SP complaining that they need to reset the accounts of our users on a periodic basis. We've been monitoring this for some time and have identified that after one of our users is forced to change their AD password
their account requires a reset.</div>
<div class=""><br class="">
</div>
<div class=""> We've further identified that when a user changes their AD password it changes their eduPersonTargetedID value. By resetting the account they clear the value set in eduPersonTargetedID and allows a new one to be set.</div>
<div class=""><br class="">
</div>
<div class=""> When I read up on this attribute I find that it's made up of a triple tuple, one of which is generated. It's also supposed to be persistent but it's persistence doesn't have to be lifetime.</div>
<div class=""><br class="">
</div>
<div class=""> Can anyone help me understand why this attribute might change after an AD password change?</div>
<div class=""><br class="">
</div>
<div class="">Thanks</div>
<div class="">-Bob<br class="">
</div>
<div class=""><br class="">
</div>
<div class="ydp5bceb085signature">
<div class="">--<br class="">
Bob Lamothe<br class="">
<a href="mailto:robert_lamothe@yahoo.com" class="">robert_lamothe@yahoo.com</a><br class="">
KB1BOB<br class="">
603-918-6336<br class="">
<br class="">
</div>
</div>
</div>
</div>
</div>
-- <br class="">
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0" class="">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
<div><span>
<pre>-- <br></pre>
<div>Ray Bon</div>
<div>Programmer Analyst</div>
<div>Development Services, University Systems</div>
<div>2507218831 | CLE 019 | rbon@uvic.ca</div>
</span></div>
</body>
</html>