<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Thanks Scott and Peter for the quick reply.
<div class=""><br class="">
</div>
<div class="">I’ll switch to using the InputDataConnector within the DataConnector definition then.</div>
<div class=""><br class="">
</div>
<div class="">Appreciate the help.</div>
<div class=""><br class="">
<div class="">
<div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
----<br class="">
Nathan Sheldon<br class="">
Systems Integration Engineer<br class="">
Identity and Access Management,<br class="">
Information Technology Services<br class="">
University of California, San Francisco</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="">
</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="">
</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="">
</div>
<div style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">
<br class="">
</div>
</div>
<br class="Apple-interchange-newline">
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Feb 3, 2020, at 11:37 AM, Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">* Sheldon, Nathan I <<a href="mailto:Nathan.Sheldon@ucsf.edu" class="">Nathan.Sheldon@ucsf.edu</a>> [2020-02-03 20:25]:<br class="">
<blockquote type="cite" class="">The documentation for the ComputedIdConnector at<br class="">
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_ComputedIdConnector&d=DwIGaQ&c=iORugZls2LlYyCAZRB3XLg&r=nu8TjafRyATXiCWMkFtf5v6w2YFX7dlXPahFfE1PUk0&m=09AFWFqqwbyZsMojOI-ub44juIcC4aWVMBuSWX69ik8&s=5Z6m1P4vSoHwwwxjNwLCzotH7Tx0BW7fDrvVsEsW1R8&e=" class="">https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_ComputedIdConnector&d=DwIGaQ&c=iORugZls2LlYyCAZRB3XLg&r=nu8TjafRyATXiCWMkFtf5v6w2YFX7dlXPahFfE1PUk0&m=09AFWFqqwbyZsMojOI-ub44juIcC4aWVMBuSWX69ik8&s=5Z6m1P4vSoHwwwxjNwLCzotH7Tx0BW7fDrvVsEsW1R8&e=</a>
<br class="">
indicates that, as of version 3.4, the sourceAttriubteID data<br class="">
connector attribute has been deprecated.<br class="">
</blockquote>
<br class="">
You can remove the sourceAttriubteID XML attribute from your<br class="">
DataConnetor.<br class="">
<br class="">
Personally I've added a child attribute to the DataConnector:<br class="">
<InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}" /><br class="">
that re-uses the same source attribute config I did for supporting<br class="">
persistent NameIDs NOT wrapped in a SAML attribute but if you're not<br class="">
using those you can avoid the indirection/property and put the<br class="">
internal identifier's attribute name into "attributeNames" above.<br class="">
<br class="">
<blockquote type="cite" class="">The saml-nameid.properties file currently has no properties defined<br class="">
(they’re all commented out).<br class="">
</blockquote>
<br class="">
Then you're not using/suporting/issuing persistent NameIDs not wrapped<br class="">
in a SAML Attribute and you shouldn't care about that file.<br class="">
<br class="">
<blockquote type="cite" class="">If I were to add "idp.persistentId.sourceAttribute =<br class="">
ucsfeduidnumber" to the properties, what value would I need to<br class="">
specify for the “idp.persistentId.useUnfilteredAttributes” and<br class="">
“idp.persistentId.algorithm” properties to prevent the ePTID from<br class="">
changing?<br class="">
</blockquote>
<br class="">
None of this matters for your attribute-resolver-defined NameIDs.<br class="">
(Having said that, the only thing you'd likely have to change is to set<br class="">
idp.persistentId.encoding to BASE64.)<br class="">
<br class="">
<blockquote type="cite" class="">Also, would switching to using the properties instead of the data<br class="">
connector defined sourceAttributeID change the behavior of the data<br class="">
sent by the shibboleth.SAML2AttributeSourcedGenerator, for which we<br class="">
have a number of attributeSourceIds defined in the saml-nameid.xml<br class="">
file?<br class="">
</blockquote>
<br class="">
I'd have to re-read that a few times but the saml-nameid.* config<br class="">
mechanism will NOT give you an eduPersonTargetedID *attribute*.<br class="">
If SPs positively require that then you can't use saml-nameid.*, at<br class="">
least not alone.<br class="">
<br class="">
-peter<br class="">
-- <br class="">
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwIGaQ&c=iORugZls2LlYyCAZRB3XLg&r=nu8TjafRyATXiCWMkFtf5v6w2YFX7dlXPahFfE1PUk0&m=09AFWFqqwbyZsMojOI-ub44juIcC4aWVMBuSWX69ik8&s=I9J_4Bh9po6B_YACkItAx_LmEwKuScTNjEq5YjGPTic&e=" class="">
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwIGaQ&c=iORugZls2LlYyCAZRB3XLg&r=nu8TjafRyATXiCWMkFtf5v6w2YFX7dlXPahFfE1PUk0&m=09AFWFqqwbyZsMojOI-ub44juIcC4aWVMBuSWX69ik8&s=I9J_4Bh9po6B_YACkItAx_LmEwKuScTNjEq5YjGPTic&e=</a>
<br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>