Shibboleth Developers

[Scott Cantor <>]

> Eh?  I thought the whole point of the targetedID implementation was that
> the per-target ID could be computed deterministically as f(user, target),
> hence no storage needed.

Except that it's not that simple (the salt value has to be part of the hash,
which locks you to that salt value forever). I had to salt it for privacy
reasons, but if you generate them randomly and store them in a database,
it's about as easy to deploy and much more maintainable long term. Plus you
can change the values periodically once we have the NameIdentifier
registration stuff, etc.

I thought the hash was a way of getting something out there people (and
vendors) could play with quickly, but I don't think I'd run it here that
way. Since we don't ship things with a database currently, that wasn't a
good option.

-- Scott