how would we suggest improving the user experience at this SP

[Ian Rifkin]

Hi,

IMHO eppn should not just be routable and unique, but but also permanent
(not user editable) since it could be used for authorization.

I have eppn = username at domain (the users default, routable email address
that doesn't change). For me that's different than "mail" which we treat as
a user-defined * publishable* mail address (the user can change it to an
alias they define).

Campuses don't really mask attributes, they just don't send them.
>

I have worked with SP vendors that require specific values for
eduPersonScopedAffiliation (different from vendor to vendor), so you could
say that I am "masking" the eduPersonScopedAffiliation attribute to meet
the vendor requirements, but maybe that's not what you mean by masking.

Ian

-- 
Ian Rifkin
Software Systems Manager
Library and Technology Services (LTS)
Brandeis University

http://go.brandeis.edu/u:irifkin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140604/86e6fd2a/attachment.html