{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"26efdf56-5972-4083-ac43-6cca4a3ef0d7"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"e9ade644-fe14-473d-bc4e-0188cb1fbc82"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML 2.0 (but not 1.x) defines a kind of ","type":"text"},{"text":"NameID","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/CONCEPT/pages/928645231"}}]},{"text":" called a \"persistent\" identifier, with a Format of ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"The term \"persistent\" refers to the fact that it's not a per-session identifier, but a stable value; in addition, SAML persistent identifiers have very particular properties, notably they're intended to be opaque and \"pairwise\". The latter means that for the most part every SP receives a different value for the same user. The term \"pairwise\" is the more typical way of describing this whole concept today, so the Format constant is unfortunate and confusing.","type":"text"}]},{"type":"paragraph","content":[{"text":"You should consider carefully whether this kind of identifier meets your needs. They can be difficult to deal with, they work very poorly with a wide variety of applications, and they are often more trouble than they're worth. Be cautious, and don't commit to supporting something you don't want to have to support.","type":"text"}]},{"type":"paragraph","content":[{"text":"There were some internal code changes in V4 but the configuration is designed to be backward-compatible. The most significant change is that a public ","type":"text"},{"text":"PairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseIdStore"}}]},{"text":" interface now exists to support third party extension of the way these values are produced and managed if it becomes necessary.","type":"text"}]},{"type":"paragraph","content":[{"text":"The IdP has a couple of built-in implementations of this interface (called \"strategies\" in the configuration) to produce this kind of identifier. The strategy used is controlled with the ","type":"text"},{"text":"idp.persistentId.generator","type":"text","marks":[{"type":"strong"}]},{"text":" property in ","type":"text"},{"text":"saml-nameid.properties","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"paragraph","content":[{"text":"It's come to light that at least some (perhaps many, or even most) applications do not support case-sensitive handling of identifiers. This SAML format is explicitly defined to be case-sensitive, but it is much, much wiser not to rely on that. Older versions of the software generate identifiers with the Base64 encoding and this is much less safe, so if you're not already supporting identifiers produced by them, you would be wise to generate the values using a Base32 encoding, which is designed to support case-insensitive applications. New installs include a property explicitly set to produce Base32 values, but upgrades of older configurations will continue to use Base64 for compatibility reasons.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling the Generator","type":"text"}]},{"type":"paragraph","content":[{"text":"To enable either approach, you will need to uncomment the generator bean in ","type":"text"},{"text":"saml-nameid.xml","type":"text","marks":[{"type":"em"}]},{"text":" for SAML 2 once you set the appropriate properties highlighted below.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"SAML 2.0 Persistent NameID Generator","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"There is no equivalent SAML 1 bean, as this is a SAML 2-only feature.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Supported Strategies","type":"text"}]},{"type":"expand","attrs":{"title":"Computed IDs"},"content":[{"type":"paragraph","content":[{"text":"The default ","type":"text"},{"text":"PairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseIdStore"}}]},{"text":" implementation is a hash/digest-based approach called \"Computed\" that avoids the need for a database to store the IDs, but is incapable of reverse-mapping a given identifier (e.g., as part of a SAML attribute query), or revoking or changing the identifier associated with a subject. Tracking back to a subject for debugging purposes generally involves the use of audit logs rather than direct access to a mapping of users. It's not the best approach in the abstract, but it is much simpler to deploy.","type":"text"}]},{"type":"paragraph","content":[{"text":"To enable the Computed strategy, you must set additional properties:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.persistentId.sourceAttribute","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A list of attributes from which to derive a \"source\" key for the subject. The key is used as the hash input, and should be a very stable value for each subject and must ","type":"text"},{"text":"never","type":"text","marks":[{"type":"strong"}]},{"text":" be reassigned later to a different subject. This should be a permanent serial number associated by an IDMS to each account, and not a name-based identifier like a login ID or email address. It should also be technology-neutral; using a GUID generated by an Active Directory is a very bad choice that will lead to problems if you ever change directories.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.persistentId.salt","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A secret string used as a default salt when hashing the subject key derived from the property above. This is required to prevent trivial attacks to determine the identifier for a given subject, and must be kept secret. Note that leading or trailing whitespace is not trimmed from the property, though using whitespace in the salt is not advisable.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"idp.persistentId.encodedSalt","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If your salt value contains special characters that Spring won't accept safely, you can work around this by base64-encoding the salt you want to use, and specifying the encoded version in this property ","type":"text"},{"text":"instead of","type":"text","marks":[{"type":"strong"}]},{"text":" the previous property. Do not set both.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"idp.persistentId.encoding","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Controls the encoding of the generated hash value. Defaults to BASE64 if not set, but new installations set this property to BASE32 to produce values without mixed case.","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"The attribute used as the source key need not be released (in the sense of an attribute filter policy) to the SP.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Dynamic Salt ","type":"text"},{"text":"4.3","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"paragraph","content":[{"text":"V4.3 introduces the option to configure a dynamic salt source using a ","type":"text"},{"text":"BiFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-jdk.cgi/java/util/function/BiFunction"}}]},{"text":" (a Java function object that takes two inputs). If a bean named ","type":"text"},{"text":"shibboleth.ComputedIdSaltLookupStrategy","type":"text","marks":[{"type":"strong"}]},{"text":" is defined, the function will override the value of the salt to use for a request, or if it returns null will suppress generation of a value entirely. This works in combination with the Sparse Override map desribed in the next section (i.e., the map overrides the ","type":"text"},{"text":"BiFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-jdk.cgi/java/util/function/BiFunction"}}]},{"text":" which overrides the default). It is also now legal to only define the ","type":"text"},{"text":"BiFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-jdk.cgi/java/util/function/BiFunction"}}]},{"text":" and omit the global salt if desired.","type":"text"}]},{"type":"paragraph","content":[{"text":"The bean is of type ","type":"text"},{"text":"BiFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-jdk.cgi/java/util/function/BiFunction"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org/opensaml/profile/context/ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"PairwiseId","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseId"}}]},{"text":">","type":"text"}]},{"type":"paragraph","content":[{"text":"The intent is that the second argument will supply details about the request such as the subject and relying party, while the first provides full access to request state.","type":"text"}]},{"type":"paragraph","content":[{"text":"A trivial example that is equivalent to just using a global salt would be:","type":"text"}]},{"type":"codeBlock","content":[{"text":" \n \n thisisasaltsalthisis\n \n ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Sparse Overrides","type":"text"}]},{"type":"paragraph","content":[{"text":"One of the disadvantages of strictly computing IDs is a loss of manageability of the values, particularly the ability to change a value should it become compromised. The IdP includes a feature allowing fine-grained override of the salt value used to generate IDs for specific users and/or relying parties, by means of a Java Map bean, which can be declared in ","type":"text"},{"text":"saml-nameid.xml,","type":"text","marks":[{"type":"em"}]},{"text":" and by default is named ","type":"text"},{"text":"shibboleth.ComputedIdExceptionMap","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"The Java type of the object is a mouthful: Map> (i.e., it's a string-keyed map whose values are themselves maps). It's easier to grasp this in practice in the example below.","type":"text"}]},{"type":"paragraph","content":[{"text":"The primary keys are the names of subjects/users, or an asterisk (*) to signify a wildcard rule.","type":"text"}]},{"type":"paragraph","content":[{"text":"The values are maps of Relying Party names to salt values. These keys are the names of relying parties or an asterisk (*) as a wildcard, and the values are either a substitute salt string to use, or can be null to block the generation of an ID altogether.","type":"text"}]},{"type":"paragraph","content":[{"text":"One use for this feature is to maintain an old salt value for a legacy service while relying on a new value for everybody else:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Overriding salt for a single SP","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\t \n\t\t\n\t\t\t\n\t\t\t\n\t\t\t\t\t\n\t\t\t\n\t\t\n\t\n","type":"text"}]}]},{"type":"expand","attrs":{"title":"Stored IDs"},"content":[{"type":"paragraph","content":[{"text":"The alternative ","type":"text"},{"text":"PairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseIdStore"}}]},{"text":" generates random identifiers on first use and stores them in a database for future use. This has some benefits and addresses some of the limitations of the computed approach, but requires a highly available database accessible to every IdP node and is very difficult (bordering on impossible) to make reliable. Note that it is ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" possible to implement such a database using asynchronous/unreliable replication. This will lead to conflicts and race conditions, and eventually a risk of errors and duplicate entries. This is the main reason it isn't easy to get working, as most applications simply can't tolerate these kinds of conflicts easily.","type":"text"}]},{"type":"paragraph","content":[{"text":"The \"vanilla\" DDL needed for this approach is:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Stored ID Table Definition","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"sql"},"content":[{"text":"CREATE TABLE shibpid (\n\tlocalEntity VARCHAR(255) NOT NULL,\n\tpeerEntity VARCHAR(255) NOT NULL,\n\tpersistentId VARCHAR(50) NOT NULL,\n\tprincipalName VARCHAR(50) NOT NULL,\n\tlocalId VARCHAR(50) NOT NULL,\n\tpeerProvidedId VARCHAR(50) NULL,\n\tcreationDate TIMESTAMP NOT NULL,\n\tdeactivationDate TIMESTAMP NULL,\n\tPRIMARY KEY (localEntity, peerEntity, persistentId)\n); ","type":"text"}]},{"type":"paragraph","content":[{"text":"You will need to define the table above in your database, and you ","type":"text"},{"text":"must","type":"text","marks":[{"type":"strong"}]},{"text":" define a primary key as shown above or the implementation will not function as intended. The absence of this constraint will normally be detected at startup time and prevent use of the mechanism.","type":"text"}]},{"type":"paragraph","content":[{"text":"Also ensure that the collation associated with the \"localId\" column is appropriate for use with the source attribute you specify. An inappropriate collation can render the attribute non-unique. In particular, it has been observed that a case-sensitive collation is needed if using the Active Directory objectSid as the source attribute, to ensure that persistent IDs are uniquely identified. \"utf8_bin\" has been found to work in this circumstance.","type":"text"}]},{"type":"paragraph","content":[{"text":"Using this strategy requires setting the properties described earlier, as well as some additional changes:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.persistentId.generator","type":"text","marks":[{"type":"strong"}]},{"text":" property needs to be set to \"shibboleth.StoredPersistentIdGenerator\".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.persistentId.dataSource","type":"text","marks":[{"type":"strong"}]},{"text":" property must be set to the name of a ","type":"text"},{"text":"DataSource","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.sql.DataSource?module=java.sql"}}]},{"text":" bean you must define. You can place it in ","type":"text"},{"text":"saml-nameid.xml","type":"text","marks":[{"type":"em"}]},{"text":" if you like (anywhere at the \"top\" level of the file).","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"A default feature of the stored strategy is that it uses the computed strategy to produce the initial identifier for each subject, to help with migration. If you don't need that to happen, you can set the ","type":"text"},{"text":"idp.persistentId.computed","type":"text","marks":[{"type":"strong"}]},{"text":" property to an empty value and ignore that feature entirely, but it isn't a terrible idea to leverage this because it hedges your bets. If you find that the stored model is unworkable in practice, you may be able to easily convert back to the computed approach if all your values are compatible with it.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"It's ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" a good idea to define a single shared DataSource bean between this feature and, for example, the ","type":"text"},{"text":"JPA StorageService feature","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631707"}}]},{"text":", even if you happen to use one database for both. The reason is that you don't want \"non-essential\" features like consent potentially interfering with the more essential use here. Separate ","type":"text"},{"text":"DataSource","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.sql.DataSource?module=java.sql"}}]},{"text":" beans will keep the pools of connections separate and prevent problems in one component from breaking the other.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Examples of each type of bean using an unspecified database and the DBCP2 pooling library (included with the IdP) follows. You will need to determine what driver class to plug into the bean definition for your database and the proper URL to use. Always use current drivers when possible; bug fixes for obscure problems tend to be frequent. When in doubt, grab a newer one.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Example persistent ID store beans in saml-nameid.xml","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n\n","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Advanced Customization","type":"text"}]},{"type":"paragraph","content":[{"text":"There are a few cases where more advanced customization of the stored approach may be required, and this is accomodated by defining your own custom bean that inherits from \"shibboleth.StoredPersistentIdGenerator\" and defines any additional bean properties required (see the ","type":"text"},{"text":"JDBCPairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.impl.JDBCPairwiseIdStore"}}]},{"text":" javadoc).","type":"text"}]},{"type":"paragraph","content":[{"text":"The option to define and reference your own bean rather than just supplying a plain ","type":"text"},{"text":"DataSource","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.sql.DataSource?module=java.sql"}}]},{"text":" is present to allow you to override the default table and column names used in the data store, the SQL queries used, the timeout, etc, but most of these settings are now accessible in V4.1 via simple Java properties and will not require a bean definition.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Properties"},"content":[{"type":"paragraph","content":[{"text":"Properties defined in ","type":"text"},{"text":"saml-nameid.properties","type":"text","marks":[{"type":"em"}]},{"text":" to customize various aspects of persistent NameID generation behavior follow:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"ff530352-0302-4f45-82f4-20f22a10376c"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"Property / Type / Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.generator","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Bean ID of a ","type":"text"},{"text":"PairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseIdStore"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ComputedPersistentIdGenerator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Identifies the strategy plugin for sourcing persistent IDs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.dataSource","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Bean ID of a JDBC ","type":"text"},{"text":"DataSource","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.sql.DataSource?module=java.sql"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Identifies a data source for storage-based management of persistent IDs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.computed","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Bean ID of a ","type":"text"},{"text":"PairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseIdStore"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ComputedPersistentIdGenerator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"May be null, Identifies a strategy plugin to use to generate the first persistent identifier for each subject, used to migrate from the computed to stored strategies","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.sourceAttribute","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Comma-delimited List","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"List of attributes to search for a value to uniquely identify the subject of a persistent identifier, it MUST be stable, long-lived, and non-reassignable","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.useUnfilteredAttributes ","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Whether or not the previous property has access to unreleased attributes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.salt","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"A secret salt for the hash when using computed persistent IDs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.encodedSalt","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Base64-encoded String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"An encoded form of the previous property","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.algorithm","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"SHA","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"The hash algorithm used when using computed persistent IDs","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.encoding","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"\"BASE64\" or \"BASE32\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"BASE64","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"The final encoding applied to the hash generated when using computed persistent IDs (BASE32 is strongly recommended for new installs)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.exceptionMap","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"text":"Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ComputedIdExceptionMap","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Advanced feature allowing revocation or regeneration of computed persistent IDs for specific subjects or services","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.queryTimeout","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"Duration","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"PT5S","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Query timeout for database access","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.transactionRetries","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"Integer","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Number of retries in the event database locking bugs cause retryable failures","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.retryableErrors","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"Comma-delimited list","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"23000,23505","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"List of error strings to identify as retryable failures","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.verifyDatabase","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"Boolean","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"When true, the connection and layout of the database is verified at bean initialization time and any failures are fatal.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.tableName","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"shibpid\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[579.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides the name of the table in the database","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.localEntityColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"localEntity\"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":8,"colwidth":[579.0]},"content":[{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Overrides database column names","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.peerEntityColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"peerEntity\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.principalNameColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"principalName\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.sourceIdColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"localId\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.persistentIdColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"persistentId\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.peerProvidedIdColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"peerProvidedId\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.createTimeColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"creationDate\"","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"idp.persistentId.deactivationTimeColumn","type":"text","marks":[{"type":"strong"}]},{"text":" 4.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]},{"type":"hardBreak"},{"text":"String","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[364.0]},"content":[{"type":"paragraph","content":[{"text":"\"deactivationDate\"","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"Beans defined in ","type":"text"},{"text":"saml-nameid.xml","type":"text","marks":[{"type":"em"}]},{"text":" and related system configuration are as follows:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"f9a73e5a-ab12-43cf-8b22-1f2fc333c16d"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[692.0]},"content":[{"type":"paragraph","content":[{"text":"Function","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.SAML2PersistentGenerator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"SAML2NameIDGenerator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.saml2.profile.SAML2NameIDGenerator"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[692.0]},"content":[{"type":"paragraph","content":[{"text":"Plugin for generating persistent identifiers using pluggable strategy","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ComputedPersistentIdGenerator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"ComputedPairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.impl.ComputedPairwiseIdStore"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[692.0]},"content":[{"type":"paragraph","content":[{"text":"Strategy plugin that generates persistent identifiers with a salted hash of an input value","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.ComputedIdSaltLookupStrategy ","type":"text"},{"text":"4.3","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"BiFunction","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.net/cgi-bin/java-jdk.cgi/java/util/function/BiFunction"}}]},{"text":"<","type":"text"},{"type":"hardBreak"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org/opensaml/profile/context/ProfileRequestContext"}}]},{"text":",","type":"text"},{"type":"hardBreak"},{"text":"PairwiseId","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.PairwiseId"}}]},{"type":"hardBreak"},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[692.0]},"content":[{"type":"paragraph","content":[{"text":"Strategy function for obtaining salt dynamically","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.StoredPersistentIdGenerator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"JDBCPairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.impl.JDBCPairwiseIdStore"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[692.0]},"content":[{"type":"paragraph","content":[{"text":"Strategy plugin that generates persistent identifiers and stores them in a database identified by a ","type":"text"},{"text":"DataSource","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.sql.DataSource?module=java.sql"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[373.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.JDBCPersistentIdStore","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[231.0]},"content":[{"type":"paragraph","content":[{"text":"JDBCPairwiseIdStore","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.attribute.impl.JDBCPairwiseIdStore"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[692.0]},"content":[{"type":"paragraph","content":[{"text":"Legacy parent bean for defining a JDBC store for persistent identifiers with additional customization not supported by existing properties; this is largely for compatibility, and ","type":"text"},{"text":"shibboleth.StoredPersistentIdGenerator","type":"text","marks":[{"type":"strong"}]},{"text":" should usually be used as a parent bean now","type":"text"}]}]}]}]}]},{"type":"paragraph"}],"version":1}