The specification Peter mentioned, which was posted and discussed yesterday on the list, is at http://middleware.internet2.edu/dir/docs/internet2-mace-dir-saml-attributes -200804.pdf Your log entry is not an example of eduPersonPrincipalName, it's a custom local attribute that has nothing to do with EPPN. -- Scott