EPPN and eduPersonTargetedID

[Tom Scavo]

On Fri, Aug 29, 2014 at 5:59 PM, Ken Weiss <ken.weiss at ucop.edu> wrote:
>
> Is the eduPersonTargetedID at least as widely used as the EPPN?

(The following answer is based on the 95 IdPs that support R&S.)

No, roughly 50% of IdPs will assert ePTID while virtually all IdPs are
capable of asserting ePPN. (Whether or not they are *willing* to
release ePPN is another question altogether.)

> Is the eduPersonTargetedID always guaranteed to be unique and stable?

The value of ePTID together with the IdP entityID is globally unique.
If by "stable" you mean "unlikely to change," the answer is yes (but
there is no guarantee that ePTID will persistent indefinitely). More
importantly, ePTID is guaranteed to be non-reassigned.

> I know
> eduPersonTargetedID is not part of the standard Research and Scholarship
> category attribute set, so I'm somewhat hesitant to change our application
> to rely on that, instead of EPPN.

Well, ePTID is included in the R&S attribute bundle but IdPs are not
required to assert it unless their ePPN may be reassigned. (Btw, 75%
of the R&S IdPs assert ePPN that is not reassigned.)

> Maybe what I really want to ask is this: What attribute do you recommend
> using as a unique identifier for a Shibboleth-authenticated user?

There's is no one right answer. For the apps we run here, we require
ePPN. To protect ourselves against reassignment (which is important in
our case), we bind the ePPN to the user's mobile device.

Hope this helps,

Tom