eppn with multiple domains

[Jones, David A]

Thanks,
We do not allow for the netid to be the same for individuals in the different domains.  In our case it's a coincidence.  We have been encouraging students to login with the UPN because it is familiar to them and it helps with some of the problems we experience by having two domains.

We do have the : <Extensions> <shibmd:Scope regexp="false">Kutztown.edu</shibmd:Scope> </Extensions> value in our metadata, however it is unclear to me from the documentation if the scope includes subdomains.  Can I write a regexp instead of defining a single domain?

Dave

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Curry, Warren
Sent: Monday, July 01, 2013 3:31 PM
To: Shib Users
Subject: RE: eppn with multiple domains

Do you allow for two individuals to have the same netid  in the different domains.

Eppn does not need to be their email address.    In fact we specifically express that that not be the case.

There can be a "coincidence that the values match but that is not a requirement.

We use netid at ufl.edu<mailto:netid at ufl.edu> for all.  Even though the email domain may vary across the university.  Eppn and email are not the same data element.

Not sure if this helps or confuses your issue but...

Warren H. Curry
UFIT - Identity Access Management
PO Box 113359,  2008 NE Waldo Rd
352-273-1383

Have a great day!!!

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Jones, David A
Sent: Monday, July 01, 2013 3:21 PM
To: users at shibboleth.net
Subject: eppn with multiple domains

We currently have an Active Directory with Staff/Faculty in the parent domain with a UPN of Kutztown.edu and Students  in the child domain with a UPN of live.kutztown.edu.  Students login with netID at live.kutztown.edu<mailto:netID at live.kutztown.edu> against AD and the intention is for them to do so with SSO as well.  We have set the eduPersonPrincipalName attribute in AD to reflect the UPN of the Staff/Faculty and the Students.  This appears to be causing some problem with one of the Service Providers that Staff/Faculty and Students are using.  As long as the EPPN is netID at kutztown.edu<mailto:netID at kutztown.edu> the login works as expected, however with the EPPN is netID at live.kutztown.edu<mailto:netID at live.kutztown.edu> the auth works, but is redirected back to the SP's login page.

Is it acceptable to have subdomains used in the EPPN attribute?

Thanks,
Dave

David A. Jones
Enterprise Systems Analyst
KU Servers & Security
Office:  610-683-4880
Cell:       610-762-4618

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130701/62efd792/attachment.html