<div dir="ltr"><div>Hi,<br><br></div><div>IMHO eppn should not just be routable and unique, but but also permanent (not user editable) since it could be used for authorization.</div><div><br>I have eppn = username@domain (the users default, routable email address that doesn't change). For
me that's different than "mail" which we treat as a user-defined <i>
publishable</i> mail address (the user can change it to an alias they define).<br></div><div><div><br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Campuses don't really mask attributes, they just don't send them.<br></blockquote><br>I have worked with SP vendors that require specific values for eduPersonScopedAffiliation (different from vendor to vendor), so you could say that I am "masking" the eduPersonScopedAffiliation attribute to meet the vendor requirements, but maybe that's not what you mean by masking.<br>
</div><div class="gmail_quote"><div><br></div><div>Ian<br></div><div><br></div></div>-- <br>Ian Rifkin<br>Software Systems Manager<br>Library and Technology Services (LTS)<br>Brandeis University<br><br><a href="http://go.brandeis.edu/u:irifkin" target="_blank">http://go.brandeis.edu/u:irifkin</a>
</div></div></div></div>