eppn with multiple domains

[Jones, David A]

We currently have an Active Directory with Staff/Faculty in the parent domain with a UPN of Kutztown.edu and Students  in the child domain with a UPN of live.kutztown.edu.  Students login with netID at live.kutztown.edu<mailto:netID at live.kutztown.edu> against AD and the intention is for them to do so with SSO as well.  We have set the eduPersonPrincipalName attribute in AD to reflect the UPN of the Staff/Faculty and the Students.  This appears to be causing some problem with one of the Service Providers that Staff/Faculty and Students are using.  As long as the EPPN is netID at kutztown.edu<mailto:netID at kutztown.edu> the login works as expected, however with the EPPN is netID at live.kutztown.edu<mailto:netID at live.kutztown.edu> the auth works, but is redirected back to the SP's login page.

Is it acceptable to have subdomains used in the EPPN attribute?

Thanks,
Dave

David A. Jones
Enterprise Systems Analyst
KU Servers & Security
Office:  610-683-4880
Cell:       610-762-4618

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130701/e1b16c8f/attachment.html