daserzw

<?xml version="1.0" encoding="UTF-8"?>

<AttributeResolver
        xmlns="urn:mace:shibboleth:2.0:resolver"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">

    <!-- ========================================== -->
    <!--      Attribute Definitions                 -->
    <!-- ========================================== -->

daserzw

---
markmap:
  colorFreezeLevel: 10
---

# .

## REFEDS

- enforce contacts

daserzw

#!/usr/bin/env python3

import requests
from xml.etree import ElementTree as ET


def strip_start(s, start):
    if s.startswith(start):
        return s[len(start):]
    return s

daserzw

<?xml version="1.0" encoding="UTF-8"?>

<AttributeResolver
    xmlns="urn:mace:shibboleth:2.0:resolver"
    xmlns:sec="urn:mace:shibboleth:2.0:security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd
                        urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd">

    <!-- ========================================== -->

daserzw

The case for an OIDC ephemeral ID

The OpenID Connect Core 1.0 specification defines two subject types, public and pairwise.

The public subject type is used to provide "the same sub (subject) value to all Clients" or Relying Parties (RPs), while the pairwise one is meant to provide "a different sub value to each Client, so as not to enable Clients to correlate the End-User's activities without permission".

In other terms, the public subject type is a globally unique persistent identifier, while the pairwise one is targeted to a specific RP.

Ephemeral vs Pairwise

daserzw

1

daserzw

### Keybase proof

I hereby claim:

  * I am daserzw on github.
  * I am davidevaghetti (https://keybase.io/davidevaghetti) on keybase.
  * I have a public key ASBRqUFDnD0OtZwQIHIQ2-C_FsADm8zpAX0PDs4Bd0x5eAo

To claim this, I am signing this object:

daserzw

#/usr/bin/env bash

pkill -f rp.py
pkill -f server.py
rm -rf oidc-swamid-federation

daserzw

#!/usr/bin/env bash

git clone https://github.com/rohe/oidc-swamid-federation.git
cd oidc-swamid-federation
python3.5 -mvenv venv
. venv/bin/activate
pip install --no-cache-dir oidcop oidcrp fedoidcendpoint fedoidcrp atomicwrites
./create_fo_bundle.py
sleep 1
cd MDSS

daserzw

# git tag
git tag -am "annotation goes here" tagname_goes_here # cut a tag
git tag -d tagname_goes_here                         # burn it
git tag -am "annotation goes here" tagname_goes_here # cut another tag
git push --tags                                      # push tags to remote
git push origin :refs/tags/tagname_goes_here         # delete tag from remote