edupersonprincipalname question

[Peter Schober]

* Lohr, Donald A - lohrda via users <users at shibboleth.net> [2022-12-07 22:53]:
> for many the actual value will look the same (mail = lohrda at jmu.edu)
> (eduPersonPrincipalName = lohrda at jmu.edu). But say you have two
> email domains, one for employees (@yyy.zzz) and one for students
> (@students.yyy.zzz), then using the eduPersonPrincipalName value of
> a student's email address value will not be correct:

No idea what "the eduPersonPrincipalName value of a student's email
address value" means but issuing email addresses in more than one
domain doesn't really change anything wrt the topic at hand, you can
still make "user at student.example.edu" the subject's ePPN value if that
is their email address.
You'd just have to make sure all such mail domains are added as
shibmd:Scope values to your IDP's metadata.

(Another case of things spilling over from email usage to
ePPN/federation/metadata if you chose to re-assert email address
values as ePPN or even SubjectId values -- though this one can
trivially be dealt with, compared to the re-assignment issue Scott
mentioned.)

-peter