<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Wed, 4 Jun 2014, at 10:48 , David Hodnett <<a href="mailto:david@pathbrite.com">david@pathbrite.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">As an SP, we are proceeding on the assumption that the IdP guarantees that this ePPN is unique for each user but the address itself is not necessarily routable. </span></div></blockquote><div><br></div><div>Sound practice; thank you.</div><br><blockquote type="cite"><div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;">Our application later asks the user to confirm the provided address is valid and gives them the opportunity to either correct it or otherwise opt-out of receiving email.<span class="Apple-converted-space"> </span></span></div></blockquote><br></div><div>You could also ask IdPs to send you the mail attribute in the SAML assertion.</div><div><br></div><div><blockquote type="cite">should we at all be concerned that a given school might send "<a href="mailto:shibboleth-support@example.edu">shibboleth-support@example.edu</a>" as the ePPN for each and every incoming user</blockquote></div><div><br></div><div>That would be an ePPN by label only. <a href="http://www.incommon.org/federation/attributesummary.html#eduPersonPrincipal">http://www.incommon.org/federation/attributesummary.html#eduPersonPrincipal</a> </div><div><br></div><div>David Bantz</div><br></body></html>