[EXTERNAL] Re: unable to capture eppn information from SAML2/POST at SP

[Peter Schober]

* O'Quinn, Dennis <DENNIS_OQUINN at homedepot.com> [2018-06-12 14:11]:
> RE: the name/id/eppn in the attribute map, yes, I did not understand
> which parm was setting what, but, Scott set me straight on that and
> I have switched it to name=eepn, id=eduPersonPrincipalName

While you can certainly do that (it's an arbitrary only internally
meaningful string) I would not call it "eduPersonPrincipalName" mainly
because IT IS NOT AN eduPersonPrincipalName ATTRIBUTE.

Keeping "eduPersonPrincipalName" as the name works around the issue
that the software stops protecting it (the way it protects the
internal attribute with an id of "eppn"), but that doesn't make it
right -- or less confusing for your co-workers or successors -- to
even more explicitly call it something which -- as I have pointed
out -- it is not.
Call it "user-id" or "broken-crap-from-clueless-idp". Or whatever.

-peter