Admin/policy question - Shibboleth users with multiple affiliations

[Nate Klingenstein]

Ken,

> How does InCommon/Shibboleth handle people that move from one institution to
> another,

InCommon is not involved since they never store personal information on users' or organizations' behalf.  The only role Shibboleth generally can have in the migration is if both IdP's are capable of expressing a common unique identifier for the user(e.g. same as sent by IdP A and IdP B).

> or have presence at more than one institution at a time?

See above about the common identifier and:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPInterestingFeatures#NativeSPInterestingFeatures-SimpleAttributeAggregation

> Here's my use case: We have an application that allows a researcher at a
> partner institution to store datasets in our archive. The dataset is
> directly associated to that particular individual. Often these individuals
> will move from one institution to another. At this point their email address
> changes, as does their primary authenticating IDP. We would like to be able
> to still know that, for instance, kweiss at ucop.edu is actually the same
> person as ken.weiss at umn.edu. As it stands today, we have to wait for the
> individual to tell us that they have a new identity. At that point we can
> re-associate their previously stored datasets with them.

You can automate the telling if the user is able to authenticate as both accounts at any juncture in time.  Your application can give the user the option to login twice, collate the sessions resulting from these two separate authentications, and retain the association between identifiers from those two logins.

> Is there any way to ensure that there is some unique opaque identifier that
> remains associated with an individual across multiple InCommon participating
> institutions?

No such common globally unique identifier exists today and it will be a challenge realizing something like that because of privacy concerns and other issues(see: SSN in the US).

> Looking at our history, it appears that today when a person
> changes institutions they get an entirely new identity, EPPN and all. Is
> there anything in the metadata that will remain constant for an individual
> across multiple instantiations of identity at multiple institutions?

The metadata doesn't describe individuals; it describes IdP's.  It's up to the IdP's to express the same information about the individual, likely using an identifier that you would have to define, or up to the user to inform the application/SP that it has two identities(and up to the application/SP to be able to understand that).

Thanks,
Nate.