Page tree

Previous Stable Release

Please note that the V3 release branch is now the previous stable release, with the current stable releases from the V4 branch.
Support for V3 will end on Dec 31, 2020.

Skip to end of metadata
Go to start of metadata

The ComputedId data connector generates an attribute from the (usually SHA-1) digest of the requesting entityID, an attribute value, and a salt that must be kept secret to prevent off-line generation of the hashes to recover the underlying attribute value.

The attribute value is therefore opaque and unique per user, per relying party, suitable for use as a SAML "persistent" NameID or "pairwise-id" Subject Attribute.

Schema Name and Location

This xsi:type is defined by the urn:mace:shibboleth:2.0:resolver schema 3.3, located at

Prior to V3.3 supplied plugins were defined by a schema type (xsi:type) in the urn:mace:shibboleth:2.0:resolver:dc namespace, the schema for which is located at This is still supported, but every element or type in the  urn:mace:shibboleth:2.0:resolver:dc namespace has an equivalently named (but not necessarily identical) version in the urn:mace:shibboleth:2.0:resolver namespace. The use of the urn:mace:shibboleth:2.0:resolver namespace also allows a relaxation of the ordering requirements of child elements to reduce strictness.\



Any of the common attributes can be specified. In addition the following attributes are supported:

stringID of the connectorThe id of the IdPAttribute that is generated


The id of the IdPAttribute used as input to the computed ID, required for older versions

saltstring. required
A salt, of at least 16 bytes, used in the computed ID

encoding 3.3.2

stringBASE64Controls the eventual text encoding of the value, this should be set to "BASE32" for new deployments (see the warning box about case sensitivity under PersistentNameIDGenerationConfiguration)
algorithm 3.4stringSHAControls the digest algorithm applied

Configuring salt prior to V3.3

Prior to release 3.3 the parser mishandled the provided salt and stripped trailing and leading spaces from it, see case IDP-982. This rendered the values incompatible with those used in V2.

A workaround is to indirect through a property: for instance:


<DataConnector id="computed" xsi:type="ComputedId" 

idp.persistentId.salt = String with Spaces before and after 

Child Elements

Any of the common child elements can be specified.


The example produces a hashed value using an input value "Foo" from a DataConnector named "DataSourceForFoo".

<DataConnector id="ComputedIDConnector" xsi:type="ComputedId" 

	<InputDataConnector ref="DataSourceForFoo" attributeNames="Foo" />

  • No labels