IdPv3 - eduPersonTargetedID - How to define and release this attribute?

[Keith Hazelton]

From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Thursday, March 17, 2016 at 10:54
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: IdPv3 - eduPersonTargetedID - How to define and release this attribute?

What I am really interested in is configuring IdPv3 to support the global R&S
category.
The information I have read[1][2] suggests that eduPersonTargetedID is
recommended and possibly required to be released to support this category
if ePPN doesn't fit certain criteria.

You probably should read this [1] if you don't know the backstory of ePTID. It is written from an SP perspective and covers a somewhat separate set of issues, but it discussed the interplay involved here. The thing you're asking about is the thing in the section labeled "SAML 2.0 Attribute" and the thing I'm talking about is before it in the section called "SAML 2.0 NameID".

I don't believe that you need to support eduPersonTargetedID in attribute form to support R&S, using a persistent NameID should be fine. I also suspect that isn't clear from R&S itself.

> I believe Scott is correct. The Global R&S requirement is really for the IdP to assert a persistent, non-reassignable identifier. If the IdP re-assigns ePPNs, then it needs to provide a different identifier. What it's called shouldn't matter, but maybe some edits to Global R&S could clarify this. Also too bad we didn't include advice like this in the just-released eduPerson (201602). Or maybe we could do a (201602bis).
            --Keith

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPTargetedID

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160317/42ea2d99/attachment-0001.html>