ComputedIdConnector

Namespace: urn:mace:shibboleth:2.0:resolver
Schema: http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd

1 Overview
2 Reference
3 Example

Overview

The ComputedId DataConnector generates a single-valued IdPAttribute from the (usually SHA-1) digest of a requester's name (in SAML, an entityID), a source attribute value, and a salt that must be kept secret to prevent off-line generation of the hashes to recover the underlying attribute value.

The attribute value is therefore opaque and unique per user, per relying party, suitable for use as a SAML "persistent" NameID or "pairwise-id" Subject Attribute and OpenID “sub” claim.

In advanced scenarios, the input to the hash can vary from the requester's identity to a different value that may be associated with the requester, allowing for multiple requesters to receive the same value. This is all "internal" to the system and is not part of the configuration of the connector, it simply does the right thing in these cases.

Reference

Name	Type	Req?	Default	Description

Name	Type	Req?	Default	Description
generatedAttributeID	string		ID of the connector	The id of the IdPAttribute that is produced
salt encodedSalt saltLookupStrategyRef ^4.3	string	Y		One of thse attributes must be supplied to act as a source of salt values for the computation. Only one of `salt` or `encodedSalt` may be set, and provide for a global/default value to use. At least 16 bytes is required, and the encoded variant allows binary or whitespace to be used via base64 encoding. The `saltLookupStrategyRef` attribute may reference a bean of type BiFunction<ProfileRequestContext,PairwiseId> that may be used to derive a salt value dynamically. These settings may be combined to allow a dynamic salt to override a global default, and if the strategy returns a null, then generation is blocked. The exceptionMapRef feature overrides both.
encoding	string		BASE64	Controls the eventual text encoding of the value, this should be set to "BASE32" for new deployments (see the warning box about case sensitivity under PersistentNameIDGenerationConfiguration)
algorithm	string		SHA	Controls the digest algorithm applied
exceptionMapRef	Bean ID			References a Spring bean defining a map of exception overrides for altering salt or suppressing generation of IDs for users and services. See the "Sparse Overrides" section in the PersistentNameIDGenerationConfiguration topic.

Example

The example produces a hashed value using an input attribute "Foo" from a DataConnector named "DataSourceForFoo".

<DataConnector id="ComputedIDConnector" xsi:type="ComputedId" 
	generatedAttributeID="ComputedID"
	salt="abcdefghijklmnopqrstuvwxyz"
	encoding="BASE32">

	<InputDataConnector ref="DataSourceForFoo" attributeNames="Foo" />

</DataConnector>