<html><head></head><body><div class="ydp8e66da8yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div><div>I'm pretty sure this is the default:</div><div><br></div><div><div><resolver:AttributeDefinition xsi:type="ad:SAML2NameID" id="eduPersonTargetedID"<br> nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" sourceAttributeID="computedID"><br> <resolver:Dependency ref="computedID" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML1XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" /><br> <resolver:AttributeEncoder xsi:type="enc:SAML2XMLObject" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" friendlyName="eduPersonTargetedID" /><br></resolver:AttributeDefinition><br><br></div><div>Regards</div><div>-Bob<br></div></div><div><br></div><div class="ydp8e66da8signature"><div>--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div></div>
<div><br></div><div><br></div>
</div><div id="yahoo_quoted_8081842193" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Tuesday, May 7, 2019, 12:22:10 PM EDT, Nate Klingenstein <ndk@signet.id> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">Robert,<br clear="none"><br clear="none">First off, eduPersonTargetedID has been deprecated a few times. I would switch to persistentId's or the new SAML standard persistent identifier if you can, but that will require coordination with the service.<br clear="none"><br clear="none">> We've been monitoring this for some time and have identified that after one of our users is forced to change their AD password their account requires a reset.<br clear="none"><br clear="none">I'd guess you've probably been using the objectGUID as the seed for the eduPersonTargetedID. That's typically a perfectly reasonable thing to do, but in this instance...<br clear="none"><br clear="none">> We've further identified that when a user changes their AD password it changes their eduPersonTargetedID value. By resetting the account they clear the value set in eduPersonTargetedID and allows a new one to be set.<br clear="none"><br clear="none">When you reset the account, the computer is removed from the domain, which makes me suspicious of a new objectGUID(and thus new eduPersonTargetedID) being generated.<br clear="none"><br clear="none"><a shape="rect" href="https://support.microsoft.com/en-us/help/216393/resetting-computer-accounts-in-windows" target="_blank">https://support.microsoft.com/en-us/help/216393/resetting-computer-accounts-in-windows</a><br clear="none"><br clear="none">"Resetting a computer account breaks that computer's connection to the domain and requires it to rejoin the domain."<br clear="none"><br clear="none"><a shape="rect" href="https://serverfault.com/questions/105486/is-the-objectguid-unique-and-will-it-ever-change" target="_blank">https://serverfault.com/questions/105486/is-the-objectguid-unique-and-will-it-ever-change</a><br clear="none"><br clear="none">> When I read up on this attribute I find that it's made up of a triple tuple, one of which is generated. It's also supposed to be persistent but it's persistence doesn't have to be lifetime.<br clear="none"><br clear="none">The most important point is that this is why you should store persistentId's/eduPersonTargetedID's in a database after they've been generated. It allows the source values to change without the identifier itself changing for providers that have already been accessed..<div class="yqt5355756384" id="yqtfd21395"><br clear="none"><br clear="none">> Can anyone help me understand why this attribute might change after an AD password change?</div><br clear="none"><br clear="none">We would need to see your configuration for the attribute to see which underlying AD attribute you're using to generate it to confirm my hypothesis, but this is a pretty strong hunch.<br clear="none"><br clear="none">Take care,<br clear="none">Nate.<br clear="none">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
</div>
</div></body></html>