<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I'm missing something and would appreciate elucidation. If the SP wants the attribute to be named ePPN in the IdP response (as I understood from the original post), how is it that creating a new attribute enables you to send ePPN with the different value. I have a similar situation, but reckoned I needed to call the unchanging numeric ePPN-like attribute something locally defined, like uanumericPN. Maybe it's the phrase "on the wire" in Rob Ansaldo's post that I don't understand.<div><br></div><div>David Bantz</div><div>UA OIT IAM</div><div><br><div><div>On Thu, 23 Aug 2012, at 07:48 , Rob Ansaldo <<a href="mailto:rlansaldo@amherst.edu">rlansaldo@amherst.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">On Aug 23, 2012, at 10:34 AM, Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br><br><blockquote type="cite">* Rob Ansaldo <<a href="mailto:rlansaldo@amherst.edu">rlansaldo@amherst.edu</a>> [2012-08-23 15:22]:<br><blockquote type="cite">We have a commercial SP that insists that our IdP assert an<br>eduPersonPrincipalName for each of our users and that this value be<br>a unique identifier for each user that will not change over<br>time. Our eppn is the user's netid, which can change over time (name<br>changes, class year change, etc). Our employeeNumber attribute does<br>not change over time and we would like to provide this attribute for<br>eppn, but just for this one SP.<br></blockquote><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"> Rob Ansaldo <<a href="mailto:rlansaldo@amherst.edu">rlansaldo@amherst.edu</a>> [2012-08-23 15:22]:</blockquote></blockquote><br><blockquote type="cite"><blockquote type="cite">Usually you would create a new attribute definition in your IdP, pull<br>in employeeNumber as value and encode it as eduPersonPrincipalName on<br>the wire.<br>Then only release this new attribute to this specific SP, not your<br>original one with netid values.<br>-peter<br>--<br></blockquote><br>Works perfectly! A little messy to have a "special" attribute for one SP, but I can live with it.<br><br></blockquote></div><br></div></body></html>