EPPN and eduPersonTargetedID

[Michael Hodges]

#It is what it is, I'm afraid. ePPN is universally supported so it
#makes sense to build an app around that assumption. Of the two
#characteristics you mentioned, non-reassignability is critical (for
#some apps) so in that case you have to workaround it.

We can ensure that ePPN is never reassigned, but we can't ensure that
it is not occasionally changed (for example when a person has two
and we consolidate).  For those apps that require it, we recommend
that they listen to our message broker for events that indicate an ePPN
change.

- Michael

Michael Hodges
Enterprise Middleware, Identity and Access Management
University of Hawaii, Information Technology Services
michael.hodges at hawaii.edu
808-956-7195 (GMT -10:00)


On Tue, Sep 2, 2014 at 10:40 AM, Tom Scavo <trscavo at gmail.com> wrote:

> (again off-topic...you can shift this over to the InC participant's
> list if you want)
>
> On Tue, Sep 2, 2014 at 3:12 PM, Ken Weiss <ken.weiss at ucop.edu> wrote:
> >
> > It would be nice if every institution
> > that's part of the InCommon federation agreed on an identifying attribute
>
> Like it or not, that attribute is ePPN, which I believe is supported
> by almost all IdPs. The eduPersonTargetedID attribute is supported by
> less than half of the IdPs (based on incomplete data cited earlier).
> The eduPersonUniqueId attribute is new and virtually non-existent.
>
> > and assured that the value for that attribute would be stable for the
> > duration of an individual's association with the institution and never
> > re-assigned to a different individual.
>
> That's a tall order but note that stability and non-reassignability
> are independent characteristics.
>
> > I thought that was EPPN, but clearly, I thought wrong.
>
> It is what it is, I'm afraid. ePPN is universally supported so it
> makes sense to build an app around that assumption. Of the two
> characteristics you mentioned, non-reassignability is critical (for
> some apps) so in that case you have to workaround it.
>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140902/ae7f3872/attachment-0001.html