how would we suggest improving the user experience at this SP

[David Bantz]

On Wed, 4 Jun 2014, at 10:48 , David Hodnett <david at pathbrite.com> wrote:

> As an SP, we are proceeding on the assumption that the IdP guarantees that this ePPN is unique for each user but the address itself is not necessarily routable.

Sound practice; thank you.

> Our application later asks the user to confirm the provided address is valid and gives them the opportunity to either correct it or otherwise opt-out of receiving email. 

You could also ask IdPs to send you the mail attribute in the SAML assertion.

> should we at all be concerned that a given school might send "shibboleth-support at example.edu" as the ePPN for each and every incoming user


That would be an ePPN by label only.  http://www.incommon.org/federation/attributesummary.html#eduPersonPrincipal 

David Bantz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140604/027de696/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140604/027de696/attachment.bin