how would we suggest improving the user experience at this SP

[James Miller]

We use email address as our primary user identifier internally, and when
originally setting up support for shibboleth, we assumed eppn was an email
address. With at least one of the IDPs we deal with, that proved to be a
unsafe assumption.

In the end, we moved to using targeted id or eppn to identify shibboleth
users, but request mail attribute so the rest of our system has the
identifier it expects.

So, having been bitten personally, I would recommend using the mail
attribute if you plan to do emaily things.



On Thu, Jun 5, 2014 at 7:14 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/5/14, 4:45 AM, "Dave Perry" <Dave.Perry at hull-college.ac.uk> wrote:
>
> >We only send the actual staff/student usernames as unconverted eppn to
> >internally hosted SPs - external SPs get the transientId (the computed
> >one) + the eduPersonScopedAffiliation (Staff or Student, which is managed
> >by IDM).
>
> I think you mean persistent ID, a transient is not used by applications.
>
> That's fine as a goal, but many applications simply do not function well
> with opaque, long, non-familiar identifiers.
>
> >So I'm taking the view that association by email address is not
> >consistent enough.
>
> If the choice is the application not working at all, or some breakage due
> to name changes, it's just the way it is.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 

James Miller

Database Engineer

Turnitin – www.turnitin.com

jmiller at turnitin.com <jdoe at turnitin.com>
510.387.5071
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140605/4744903a/attachment.html