edupersonprincipalname question

[Lohr, Donald A - lohrda]

Referring to 
http://software.internet2.edu/eduperson/internet2-mace-dir-eduperson-201602.html#eduPersonPrincipalName

states:
.....where the "scope" portion MUST be the administrative domain of the 
identity system where the identifier was created and assigned.
.....ePPN looks like an email address but is not intended to be a 
person's published email address or be used as an email address.



I approach it that the @yyy.zzz for the mail attribute is an email 
address domain and the at yyy.zzz for the eduPersonPrincipalName attribute 
is a DNS domain.

Yes for many the actual value will look the same (mail = lohrda at jmu.edu) 
(eduPersonPrincipalName = lohrda at jmu.edu). But say you have two email 
domains, one for employees (@yyy.zzz) and one for students 
(@students.yyy.zzz), then using the
eduPersonPrincipalName value of a student's email address value will not 
be correct:

user at yyy.zzz (eduPersonPrincipalName) does not equal 
user at student.yyy.zzz (mail).

Don


On 12/7/22 2:50 PM, Wigfall, Robert via users wrote:
> CAUTION: This email originated from outside of JMU. Do not click links or open attachments unless you recognize the sender and know the content is safe.
> ________________________________
>
> Hello -
>
> We are considering changing our edupersonprincaplename attribute. We have migrated to a new IDP and seek to correct any attributes per the eduperson standards and specs on wiki.refeds.org.
>
> The proposed change would result in the eppn being the users actual email. I realize the definition indicates eppn is not intended to be a person’s published email address, or to be used as an email address. I am just curious if any are using email address as eppn and if there are any repercussions of which we need to be aware?
>
> Thanks for any input.
>
> Robert Wigfall
> INFORMATION TECHNOLOGY
> SIU.EDU
> --
> For Consortium Member technical support, seehttps://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!N6YHze6lT7thMl0!KUgFppfqsgRLtddnSJBYQeigsYZdhOFXm7Qo0phKdMQxVydSLLqcpkhlMycG9ZTvtgcEuZ2A8cef3-4f$
> To unsubscribe from this list send an email tousers-unsubscribe at shibboleth.net

-- 
D o n a l d   L o h r
I n f o r m a t i o n   S y s t e m s
J a m e s   M a d i s o n   U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20221207/07780aff/attachment.htm>