Admin/policy question - Shibboleth users with multiple affiliations

[cckweiss]

How does InCommon/Shibboleth handle people that move from one institution to
another, or have presence at more than one institution at a time?

Here's my use case: We have an application that allows a researcher at a
partner institution to store datasets in our archive. The dataset is
directly associated to that particular individual. Often these individuals
will move from one institution to another. At this point their email address
changes, as does their primary authenticating IDP. We would like to be able
to still know that, for instance, kweiss at ucop.edu is actually the same
person as ken.weiss at umn.edu. As it stands today, we have to wait for the
individual to tell us that they have a new identity. At that point we can
re-associate their previously stored datasets with them.

Is there any way to ensure that there is some unique opaque identifier that
remains associated with an individual across multiple InCommon participating
institutions? Looking at our history, it appears that today when a person
changes institutions they get an entirely new identity, EPPN and all. Is
there anything in the metadata that will remain constant for an individual
across multiple instantiations of identity at multiple institutions?





--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Admin-policy-question-Shibboleth-users-with-multiple-affiliations-tp7590099.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.