How to properly generate eduPersonTargetedID based on an existing attribute from LDAP?

So far I have approximately the following in attribute-resolver.xml:

<AttributeDefinition xsi:type="ScriptedAttribute" id="eduPersonTargetedID">
    <Dependency ref="testLDAP" />
    <AttributeEncoder xsi:type="SAML2String" name="urn:oid:" friendlyName="eduPersonTargetedID" encodeType="false" />

        if((typeof testLDAPAttribute === "object") {
            memberOf.getValues().forEach(function(value, index, _){
                if (dn_match_regex.test(dn)) eduPersonTargetedID.addValue(value);


The problem with it: the attribute is not "opaque":

It MAY be a pseudorandom value generated and stored by the identity provider, or MAY be derived from some function over the audience's identity and other principal-specific input(s), such as a serial number or UUID assigned by the identity provider.


How do I generate a unique persistent value for each SP for this attribute?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.