[EXT] non-conforming values of eduPersonAffiliation

[IAM David Bantz]

To be more explicit, the constraint is HR's population of 'supervisor' into
the directory that is the issue: they already populate conforming ePA
values and can add the 'supervisor' value as part of the routine sync to
the record of users who are supervisors, but they do NOT want to revise or
add a new process to populate the value to a different attribute in AD. Or
rather they will put it on their plan for future work, delaying the
deployment of a new contracted service.

On Mon, Aug 25, 2025 at 3:54 PM Paul B. Henson <henson at cpp.edu> wrote:

> > From: David Bantz
> > Subject: [EXT] non-conforming values of eduPersonAffiliation
> >
> > What are the practical consequences of accepting such a non-conforming
> value?
> > Of course I realize there are multiple alternative tactics that would
> not violate
> > the ePA spec
>
> We have a local schema cppEduPerson with a corresponding
> cppEduPersonAffiliation we use to deal with local affiliations that aren't
> part of the standard. If they're willing to accept a different attribute
> with the same values plus the extra magic stuff that's a fairly simple
> alternative tactic.
>
> > positioning IAM as a roadblock to deploying this service. Other than my
> shame,
> > what would this entail? Are services that consume ePA likely to choke on
> an
> > unexpected out-of-spec value? Will our IdP be cast out of InCommon?
>
> Otherwise, you could always make it a scripted attribute or have multiple
> definitions with activation conditions such that the nonstandard values for
> the attribute only show up where they are supposed to and not other random
> consumers of the attribute.
>
> OTOH, I've always refused to use nonstandard values for standardized
> attributes. I've never said we would get booted out of InCommon for
> violating their standards, but I've also never said there wouldn't
> potentially be repercussions ;)...
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250825/1d3e93ec/attachment.htm>