> I thought Paul was asking whether you could use the SID as the actual
> value.
In that case you are absolutely right (of course)..
> I think what your saying is that by using the entityID of the SP the
> software effectively
> ensures that each SP gets a different EPTID thus ensuring that the
> Federations rules are followed.
Nigel
-----Original Message-----
From: Discussion list for Shibboleth developments
[mailto:[log in to unmask]] On Behalf Of Rod Widdowson
Sent: 06 May 2009 15:10
To: [log in to unmask]
Subject: Re: Attribute Definitions and metadatatool
> I think (someone will correct me if I'm wrong) that you can't use the SID
> as the EPTI because the
> Federation rules oblige you to return a different EPTI value to each SP.
Nigel,
you are indeed wrong. The Shib software take that into account. What the
PersistentIDAttributeDefinition does is in fact take a triple
- what you give it
- The salt you give it
- The entityID of the requestion SP
And mungs them into some funky hash. It then throws it at the SP.
This is why Resolvertest won't issue a EPTID unless you give it an SP
entiyID
/Rod
|