 |
 |
Rod OK so what your saying is that you can use the SID as the basis for generating a unique EPTID for each SP. I thought Paul was asking whether you could use the SID as the actual value. I think what your saying is that by using the entityID of the SP the software effectively ensures that each SP gets a different EPTID thus ensuring that the Federations rules are followed. Nigel -----Original Message----- From: Discussion list for Shibboleth developments [mailto:[log in to unmask]] On Behalf Of Rod Widdowson Sent: 06 May 2009 15:10 To: [log in to unmask] Subject: Re: Attribute Definitions and metadatatool > I think (someone will correct me if I'm wrong) that you can't use the SID > as the EPTI because the > Federation rules oblige you to return a different EPTI value to each SP. Nigel, you are indeed wrong. The Shib software take that into account. What the PersistentIDAttributeDefinition does is in fact take a triple - what you give it - The salt you give it - The entityID of the requestion SP And mungs them into some funky hash. It then throws it at the SP. This is why Resolvertest won't issue a EPTID unless you give it an SP entiyID /Rod