IdPv3 - eduPersonTargetedID - How to define and release this attribute?

[Tom Scavo]

On Thu, Mar 17, 2016 at 6:21 PM, Keith Hazelton <keith.hazelton at wisc.edu> wrote:
>
> I don't believe that you need to support eduPersonTargetedID in attribute
> form to support R&S, using a persistent NameID should be fine. I also
> suspect that isn't clear from R&S itself.
>
>> I believe Scott is correct. The Global R&S requirement is really for the
>> IdP to assert a persistent, non-reassignable identifier. If the IdP
>> re-assigns ePPNs, then it needs to provide a different identifier. What it's
>> called shouldn't matter, but maybe some edits to Global R&S could clarify
>> this.

The REFEDS Research & Scholarship specification [1] is very clear about this:

<quote>
For the purposes of access control, a non-reassigned persistent
identifier is required. If your deployment of eduPersonPrincipalName
is non-reassigned, it will suffice. Otherwise you MUST release
eduPersonTargetedID (which is non-reassigned by definition) in
addition to eduPersonPrincipalName.
</quote>

If we could do it over again, I would expect a slightly different
requirement, but it is what it is and it can't be changed without
versioning the spec.

Tom

[1] http://refeds.org/category/research-and-scholarship