non-conforming values of eduPersonAffiliation

[IAM David Bantz]

Our HR is deploying a service and integrating with SSO that is requiring an
indication that a user is (or isn't) a supervisor. They assert they can
readily add "supervisor" to the existing extract from HRIS to AD that
populates eduPersonAffiliation with 'student,' 'faculty,', 'employee,' etc.
(controlled vocabulary).

What are the practical consequences of accepting such a non-conforming
value? Of course I realize there are multiple alternative tactics that
would not violate the ePA spec, but a firm "No" to their "easy button"
work-around risks positioning IAM as a roadblock to deploying this service.
Other than my shame, what would this entail? Are services that consume ePA
likely to choke on an unexpected out-of-spec value? Will our IdP be cast
out of InCommon?

David St Pierre Bantz
UA IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250825/046cfda4/attachment.htm>