IdPv3 - eduPersonTargetedID - How to define and release this attribute?

[Tom Scavo]

On Thu, Mar 17, 2016 at 7:03 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 3/17/16, 6:57 PM, "users on behalf of Tom Scavo" <users-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:
>
>>For the record, the point I was trying to make was: ePTID shouldn't be
>>a strict requirement for R&S. As it turns out, eduPersonUniqueId is
>>actually a better choice (but ePUId didn't exist at the time the R&S
>>spec was written).
>
> And in general that just "any" identifier meeting the requirements isn't enough, because the point was to give SPs specific attributes to handle and not require them to keep adding things to the list.

Right, but there's a tradeoff between what the SP is willing/able to
consume and what the IdP is willing/able to assert. If we ever get the
chance to do this again, we probably want to write the specification
in terms of meta-attributes. For example, an IdP that supports R&S
might be required to release a meta-attribute called "Shared User
Identifier:"

<definition>

Shared User Identifier

FriendlyName: metaSharedUserID
Name: http://id.example.org/attribute/metaSharedUserID

A metaSharedUserID is a persistent, non-reassigned, non-targeted identifier.

An Identity Provider (or Attribute Authority) is said to release a
metaSharedUserID when it releases one of the following attributes on
the wire:

1) eduPersonUniqueId
2) eduPersonPrincipalName (if non-reassigned)
3) OpenID Connect public sub claim

A Service Provider is said to request a metaSharedUserID when it does
so directly, as shown in the following example:

<md:RequestedAttribute FriendlyName="metaSharedUserID"
   Name="http://id.example.org/attribute/metaSharedUserID"
   NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"/>

</definition>

We want to be flexible but not too flexible.

Tom