edupersonprincipalname question

[Cantor, Scott]

> The proposed change would result in the eppn being the users actual email.
> I realize the definition indicates eppn is not intended to be a person’s
> published email address, or to be used as an email address.

Those statements aren't the same thing. There's nothing that says EPPN can't be an email address or the same as the email address. Only that assuming it is will cause problems.

What that means is that if you make it different, you will end up with lots of federated apps misusing it and having problems, whereas if you make it the same, anything behaving correctly doesn't care, while anything behaving incorrectly also doesn't care, and just works.

That is, you can do the "right" thing and deal with the pain, or do the perfectly allowed thing, and have less pain. I have always favored that route, because ultimately it doesn't cause significant problems for me or my organization. So when I had to pick, I used our email address and I have never questioned that decision.

The problems come about when you have questionable practices with email addresses that bleed back onto EPPN. Technically you can re-assign EPPNs, but you most definitely shouldn't, and if the choice is between a non-reassigned EPPN that breaks apps and a re-assigned EPPN that matches email, I'd do the non-reassigned.

-- Scott