lists.internet2.edu

[David Bantz]

My users relying on InC federation authenticate but fail authorization to https://lists.internet2.edu with the message 
INTERNAL SERVER ERROR (sso_login) - Failed to get your email address from the authentication service.

OK, I'm not releasing an email address to this service yet; by default we only release transientID and eduPersonAffiliation.
But I'm wondering just what to release:

mail attribute from LDAP ?  that is in principle multi-valued, and while a routable address, may be different from the address of the actual account appearing in the email header (the difference between routable db at alaska.edu and the mail account dabantz at alaska.edu), thus perhaps a recipe for not being allowed to post. 

mailRoutingAddress ? That is the account to which other addresses are routed, but is not what is generally published as the user's email address.

In many (most?) instances these are the same single value, but not knowing the internals of the service, I'm unsure which attribute to release to best match the needs of the service.

David Bantz
U Alaska