eduPersonTargetedID

A persistent, service-specific pseudonym that opaquely but uniquely identifies the subject.

Note: While still in widespread use, this attribute is deprecated in favour of the newer (and better defined) pairwise-id.

Single valued, guaranteed unique for a specific service provider. Not transferable between different service providers. The name identifier value will not be longer than 256 characters in length, but the exact presentation (and thus length) of this attribute is defined by the service provider.

eduPersonTargetedId is generated by the Federation Operator as a hash based on the home institution of the user, their incoming eduPersonPrincipalName, the entity ID of the service, and a secret value. Institutions or services that are in production and change one of these variables will cause a eduPersonTargetedID to be generated. This can cause users to lose access to their profiles, and is strongly discouraged.

• eduPerson

eduPersonTargetedID is an abstracted version of the SAML V2.0 Name Identifier format of “urn:oasis:names:tc:SAML:2.0:nameid-format:persistent”. In SAML, this is an XML construct consisting of a string value inside a <saml:NameID> element along with a number of XML attributes, of most significance NameQualifier and SPNameQualifier, which identify the source and intended audience of the value. Per the SAML format definition, the identifier portion must not exceed 256 characters, and the source and audience URI values must not exceed 1024 characters.

In SAFIRE’s case, the attribute consists of a <saml:NameID> element with the audience URI (SPNameQualifier) set to the entityID of the service provider. The name identifier value typically consists of a 40 character SHA1 hash generated from private information, but we reserve the right to change the algorithm and/or increase the length of this in future.

While eduPersonTargetedID is transmitted as a <saml:NameID> on the wire, it is often rendered in software as https://proxy.safire.ac.za/birk.php/idp.example.net/shibboleth/idp!https://sp.example.ac.za/Shibboleth.sso/Metadata!24d66f51ac1c0b140e617af335b9abb4b8d88a5b. Using the default Shibboleth NameIDAttributeDecoder formatter results in a decoded attribute with a theoretical maximum length of 2306 characters, although in practice the values seen in SAFIRE tend to be far below this. Other formatters may render the attribute differently.