EPPN and eduPersonTargetedID

[Eric Goodman]

Fair enough on all points. 

May still merit a survey though... :)

--- Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, August 29, 2014 4:40 PM
To: Shib Users
Subject: Re: EPPN and eduPersonTargetedID

On 8/29/14, 7:32 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:
>
>Within the UC System, I know that at least some of the IdPs generate 
>ePTIDs based on a dynamic hash of some attribute and the SP name. What 
>that means is that if the "some attribute" changes then the presumption 
>of persistence -- and possibly non-reassignability -- is lost.

If you violate non-reassignment, you are grossly violating the standard.
That should not be something SPs give any consideration to in their designs, particularly given that most of them don't even address the fact that EPPN doesn't have this property.

>[For longtime readers, this post is basically my ongoing "ForceAuthn 
>issues" commentary translated to ePTID values... :)]

There's no gray here though, the spec is 100% clear and explicit on it.
This is why supporting persistent IDs is a very deliberate decision and is not an out of the box feature, and thus also much less widely deployed than simpler username attributes.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net