Admin/policy question - Shibboleth users with multiple affiliations

[Ken Weiss]

Thanks for the quick response, Nate. Yeah, that's kind of what I figured.
It would come down to the IDPs agreeing on a common opaque unique
identifier, with infrastructure to manage that across multiple
institutions. That's why I called this an admin/policy question. I was
just hoping someone had already grappled with this and come up with a
framework.

I like the idea of automating the association where the individual can log
in to both accounts at once. I hadn't thought of that one.

--Ken




On 9/19/13 11:12 AM, "Nate Klingenstein" <ndk at internet2.edu> wrote:

>Ken,
>
>> How does InCommon/Shibboleth handle people that move from one
>>institution to
>> another,
>
>InCommon is not involved since they never store personal information on
>users' or organizations' behalf.  The only role Shibboleth generally can
>have in the migration is if both IdP's are capable of expressing a common
>unique identifier for the user(e.g. same as sent by IdP A and IdP B).
>
>> or have presence at more than one institution at a time?
>
>See above about the common identifier and:
>
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPInterestingFe
>atures#NativeSPInterestingFeatures-SimpleAttributeAggregation
>
>>