EPPN and eduPersonTargetedID

[Cantor, Scott]

On 8/29/14, 7:32 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:
>
>Within the UC System, I know that at least some of the IdPs generate
>ePTIDs based on a dynamic hash of some attribute and the SP name. What
>that means is that if the "some attribute" changes then the presumption
>of persistence -- and possibly non-reassignability -- is lost.

If you violate non-reassignment, you are grossly violating the standard.
That should not be something SPs give any consideration to in their
designs, particularly given that most of them don't even address the fact
that EPPN doesn't have this property.

>[For longtime readers, this post is basically my ongoing "ForceAuthn
>issues" commentary translated to ePTID values... :)]

There's no gray here though, the spec is 100% clear and explicit on it.
This is why supporting persistent IDs is a very deliberate decision and is
not an out of the box feature, and thus also much less widely deployed
than simpler username attributes.

-- Scott