how would we suggest improving the user experience at this SP

[Cantor, Scott]

On 6/4/14, 4:36 PM, "Ian Rifkin" <irifkin at brandeis.edu> wrote:
>
>IMHO eppn should not just be routable and unique, but but also permanent
>(not user editable) since it could be used for authorization.

Permanent tends to have a different meaning.

As far as being controlled, that's always been implicit, I guess, but for
the record...

>I have eppn = username at domain (the users default, routable email address
>that doesn't change). For me that's different than "mail" which we treat
>as a user-defined publishable mail address (the user can change it to an
>alias they define).

Apps all over use email addresses for authorization whether we like it or
not, so that's just one of the problems with using the "mail" attribute in
SAML.

>I have worked with SP vendors that require specific values for
>eduPersonScopedAffiliation (different from vendor to vendor), so you
>could say that I am "masking" the eduPersonScopedAffiliation attribute to
>meet the vendor requirements, but maybe that's not what you mean by
>masking.

I meant setting something to "Foo" for everybody instead of just refusing
to provide the attribute.

-- Scott