Rod
OK so what your saying is that you can use the SID as the basis for generating a unique EPTID for each SP. I thought Paul was asking whether you could use the SID as the actual value. I think what your saying is that by using the entityID of the SP the software effectively ensures that each SP gets a different EPTID thus ensuring that the Federations rules are followed.
Nigel
-----Original Message-----
From: Discussion list for Shibboleth developments [mailto:[log in to unmask]] On Behalf Of Rod Widdowson
Sent: 06 May 2009 15:10
To: [log in to unmask]
Subject: Re: Attribute Definitions and metadatatool
> I think (someone will correct me if I'm wrong) that you can't use the SID
> as the EPTI because the
> Federation rules oblige you to return a different EPTI value to each SP.
Nigel,
you are indeed wrong. The Shib software take that into account. What the
PersistentIDAttributeDefinition does is in fact take a triple
- what you give it
- The salt you give it
- The entityID of the requestion SP
And mungs them into some funky hash. It then throws it at the SP.
This is why Resolvertest won't issue a EPTID unless you give it an SP
entiyID
/Rod
|