<div dir="ltr"><div><br></div><div class="gmail_extra"><div class="gmail_quote">On Wed, Jun 4, 2014 at 11:26 AM, David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><br></div><div>
<div>If starting identity management or institutional email from scratch, I would like a policy </div><div>requiring an unchanging identifier that would be used for ePPN and a persistent </div><div>routable email address. I would also expect a lot of resistance from several quarters</div>
<div>(in principal, because it represents a constraint on their authority for unilateral decisions).</div><div><br></div><div>David Bantz</div><div><br></div></div></div></div></blockquote></div><br></div><div class="gmail_extra">
As an SP, we are proceeding on the assumption that the IdP guarantees that this ePPN is unique for each user but the address itself is not necessarily routable. Our application later asks the user to confirm the provided address is valid and gives them the opportunity to either correct it or otherwise opt-out of receiving email. I've always felt that this was a reasonable compromise given that each institution has its own privacy policy for political reasons as David Bantz implied.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">However, based on the tone of this thread, should we at all be concerned that a given school might send "<a href="mailto:shibboleth-support@example.edu">shibboleth-support@example.edu</a>" as the ePPN for each and every incoming user, again for political reasons?</div>
<div class="gmail_extra"><br></div><div class="gmail_extra"><div><div dir="ltr">David Hodnett<div><a href="mailto:david@pathbrite.com" target="_blank">david@pathbrite.com</a></div><div><a href="http://pathbrite.com/" target="_blank">http://pathbrite.com</a></div>
<div>@pathbrite</div><div><br></div></div></div></div></div>