EPPN and eduPersonTargetedID

[Cantor, Scott]

On 8/29/14, 5:59 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:
>
>Maybe what I really want to ask is this: What attribute do you recommend
>using as a unique identifier for a Shibboleth-authenticated user?

As another response mentioned, if you have more than one SP entityID, a
SAML persistent NameID (*) is going to vary for each one. That alone may
render it useless to you as an identifier. There are ways around it, but
not ones you'll get random IdPs to work with you on.

One practice is to use the persistent ID to recognize that a given EPPN is
the same user as an earlier one by looking at and storing both, and noting
when EPPN changes but the persistent ID doesn't.

Lastly, there's an attribute I proposed, eduPersonPrincipalNamePrior, to
carry a list of older EPPNs for a person, to help identify changes. It's
also not widely supported, but is another way of handling change
identification in-band.

All of this is about changes of identifiers, while reassignment is in fact
a much bigger concern.

-- Scott

(*) eduPersonTargetedID in SAML is a Subject NameID with the "persistent"
Format. The attribute was just an eduPerson concept to represent it
abstractly.