EPPN and eduPersonTargetedID

[David Bantz]

" ePPN looks like an email address but is not intended to be a person's published email address or be used as an email address. In general, name-based identifiers tend to be subject to some degree of expected change and/or reassignment,”  so arguably the practice of changing ePPN when a user changes email address is less than best practice.
https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonPrincipalName

ePTID is defined as “persistent” ~ "SHOULD be maintained...long enough to be useful as a key for consuming services.”
https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonTargetedID

ePTID is opaque and not necessarily human-friendly.  You mention “several applications [and] SPs”; if you hope for correlation of identities between these applications, ePTID may not be what 
you want as the value will likely be different for different SPs.



On Fri, 29 Aug 2014, at 13:59 , Ken Weiss <ken.weiss at ucop.edu> wrote:

> Hi,
> 
> I'm not sure if this is a question for this list or not. If I'm in the
> wrong place, please direct me to the right place...
> 
> We have several applications sitting behind Shibboleth SPs that rely on
> the EPPN to uniquely identify a user. One of the IDPs with which we
> integrate just told me that they use the authenticated user's email
> address as the EPPN. Because email addresses change frequently, so do the
> EPPNs in this IDP. The IDP manager did mention, though, that they also use
> the eduPersonTargetedID attribute, and that one is guaranteed to be both
> unique and stable.
> 
> Is the eduPersonTargetedID at least as widely used as the EPPN? Is the
> eduPersonTargetedID always guaranteed to be unique and stable? I know
> eduPersonTargetedID is not part of the standard Research and Scholarship
> category attribute set, so I'm somewhat hesitant to change our application
> to rely on that, instead of EPPN.
> 
> Maybe what I really want to ask is this: What attribute do you recommend
> using as a unique identifier for a Shibboleth-authenticated user?
> 
> --Ken
> 
> ------------------------------------------------------------
> Ken Weiss                                 ken.weiss at ucop.edu
> UC Office of the President              510-587-6311 (office)
> California Digital Library              916-905-6933 (mobile)
> UC Curation Center
> 415 20th Street, 4th Floor
> Oakland, CA 94612
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140829/52460d33/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140829/52460d33/attachment-0001.bin