<html><head></head><body><div class="ydpfebb4044yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div><div>In my config it's commented out:</div><div><br></div><div><span>#idp.persistentId.sourceAttribute = changethistosomethingreal</span></div><div><span><br></span></div><div><span>What is the default of this?</span></div><div><span><br></span></div><div><span>Regards</span></div><div><span>-Bob</span><br></div><div><br></div><div class="ydpfebb4044signature"><div>--<br>Bob Lamothe<br>robert_lamothe@yahoo.com<br>KB1BOB<br>603-918-6336<br><br></div></div></div>
<div><br></div><div><br></div>
</div><div id="yahoo_quoted_7559398017" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Tuesday, May 7, 2019, 12:13:59 PM EDT, Yeargan, Yancey <Yancey.Yeargan@untsystem.edu> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="yiv6642369846"><div>
Take a look at the conf/saml-nameid.properties file, specifically the property "idp.persistentId.sourceAttribute". If that AD attribute changes as a result of a password change, then the value of eduPersonTargetedID will also change.
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846">--</div>
<div class="yiv6642369846">Yancey Yeargan</div>
<div class="yiv6642369846">University of North Texas System</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
<div class="yiv6642369846">
<div><br class="yiv6642369846" clear="none">
<blockquote class="yiv6642369846" type="cite">
<div class="yiv6642369846yqt1503174605" id="yiv6642369846yqt95071"><div class="yiv6642369846">On May 7, 2019, at 10:56 AM, Robert Lamothe <<a rel="nofollow" shape="rect" class="yiv6642369846" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a>> wrote:</div>
<br class="yiv6642369846Apple-interchange-newline" clear="none">
<div class="yiv6642369846">
<div class="yiv6642369846">
<div class="yiv6642369846ydp5bceb085yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;">
<div class="yiv6642369846">
<div class="yiv6642369846">Howdy,</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846"> For a few months I've had an SP complaining that they need to reset the accounts of our users on a periodic basis. We've been monitoring this for some time and have identified that after one of our users is forced to change their AD password
their account requires a reset.</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846"> We've further identified that when a user changes their AD password it changes their eduPersonTargetedID value. By resetting the account they clear the value set in eduPersonTargetedID and allows a new one to be set.</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846"> When I read up on this attribute I find that it's made up of a triple tuple, one of which is generated. It's also supposed to be persistent but it's persistence doesn't have to be lifetime.</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846"> Can anyone help me understand why this attribute might change after an AD password change?</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846">Thanks</div>
<div class="yiv6642369846">-Bob<br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846"><br class="yiv6642369846" clear="none">
</div>
<div class="yiv6642369846ydp5bceb085signature">
<div class="yiv6642369846">--<br class="yiv6642369846" clear="none">
Bob Lamothe<br class="yiv6642369846" clear="none">
<a rel="nofollow" shape="rect" class="yiv6642369846" ymailto="mailto:robert_lamothe@yahoo.com" target="_blank" href="mailto:robert_lamothe@yahoo.com">robert_lamothe@yahoo.com</a><br class="yiv6642369846" clear="none">
KB1BOB<br class="yiv6642369846" clear="none">
603-918-6336<br class="yiv6642369846" clear="none">
<br class="yiv6642369846" clear="none">
</div>
</div>
</div>
</div>
</div>
-- <br class="yiv6642369846" clear="none">
For Consortium Member technical support, see <a rel="nofollow" shape="rect" class="yiv6642369846" target="_blank" href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cdad55e69bed342d399d608d6d3048bbd%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C636928413808439771&sdata=mi8rzW4b3cxphulQ%2FNyFyctb75yxMW98fIsCmHD63oM%3D&reserved=0</a><br class="yiv6642369846" clear="none">
To unsubscribe from this list send an email to <a rel="nofollow" shape="rect" class="yiv6642369846" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></div></div>
</blockquote>
</div>
<br class="yiv6642369846" clear="none">
</div>
</div>
</div></div><div class="yqt1503174605" id="yqt29078">-- <br clear="none">For Consortium Member technical support, see <a shape="rect" href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br clear="none">To unsubscribe from this list send an email to <a shape="rect" ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
</div>
</div></body></html>