eduPersonTargetedId

[Tom Scavo]

On Fri, Nov 10, 2017 at 12:57 PM, IAM David Bantz <dabantz at alaska.edu> wrote:
>
> We use eduPersonUniqueId for unchanging assigned identifier ...

Smart move. That is the best user identifier we have at this time. (I
don't know what Scott and the others are cooking up.)

Under what conditions do you release eduPersonUniqueId?

An IdP should *always* release eduPersonUniqueId, upon every request.
If you can't (for policy reasons, or whatever), you won't be able to
support OpenID Connect when it finally arrives since the OIDC protocol
mandates the release of a persistent, non-reassigned identifier upon
every request.

Tom