eppn with multiple domains

[Etan Weintraub]

Typically, your metadata includes the valid scope for your domain (i.e. in ours, there is the following line: <Extensions> <shibmd:Scope regexp="false">johnshopkins.edu</shibmd:Scope> </Extensions>). If your metadata has the same thing with kutztown.edu, I would suspect that it would fail if you sent @live.kutztown.edu.


-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Jones, David A
Sent: Monday, July 01, 2013 3:21 PM
To: users at shibboleth.net
Subject: eppn with multiple domains

We currently have an Active Directory with Staff/Faculty in the parent domain with a UPN of Kutztown.edu and Students  in the child domain with a UPN of live.kutztown.edu.  Students login with netID at live.kutztown.edu<mailto:netID at live.kutztown.edu> against AD and the intention is for them to do so with SSO as well.  We have set the eduPersonPrincipalName attribute in AD to reflect the UPN of the Staff/Faculty and the Students.  This appears to be causing some problem with one of the Service Providers that Staff/Faculty and Students are using.  As long as the EPPN is netID at kutztown.edu<mailto:netID at kutztown.edu> the login works as expected, however with the EPPN is netID at live.kutztown.edu<mailto:netID at live.kutztown.edu> the auth works, but is redirected back to the SP's login page.

Is it acceptable to have subdomains used in the EPPN attribute?

Thanks,
Dave

David A. Jones
Enterprise Systems Analyst
KU Servers & Security
Office:  610-683-4880
Cell:       610-762-4618

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130701/402f4e60/attachment.html