InCommon Technical Discussions

["Wessel, Keith" <>]

Jim,

If you don't mind me asking, why are the EPTID values changing? IdP deployers 
forgetting to carry over their salt when upgrading? IIRC, Illinois's EPTID 
values were messed up for about four hours after upgrading due to a 
copy/paste error in the salt that I copied from V2 to V3. You were actualy 
the one who reported the error to me. :)

I'm curious why so many are changing. That, in my mind, is the question.

Keith


-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Basney, Jim
Sent: Wednesday, June 07, 2017 4:47 PM
To: 

Subject: [InC-Technical] ePTID changes caused by Shibboleth IdPv3 upgrade

Hi,

Are any other InCommon SPs besides CILogon being routinely impacted by ePTID 
changes when InCommon IdPs upgrade to Shibboleth IdPv3? For CILogon the ePTID 
changes trigger an ePPN reassignment workflow (i.e., "it appears your ePPN 
has been reassigned") that results in users of the upgraded IdP losing access 
to their existing CILogon accounts. These IdPv3-upgrade ePTID changes have 
been causing CILogon user support requests from December 2015 up to today.

Is CILogon an outlier for checking ePTID values? IdP operators tell us we're 
wrong for thinking the ePTID changes are a problem. Since 100+ InCommon IdPs 
still need to upgrade from Shibboleth IdP V2 to V3 [1], I think this problem 
isn't going away any time soon.

I appreciate your advice and perspectives.

Thanks,
Jim

[1] 
https://spaces.internet2.edu/display/InCFederation/List+of+Shibboleth+IdPs+by+Version