<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><font face="Calibri" style="font-size: 14px;"><font>"</font> ePPN looks like an email address but is not intended to be a person's published email address or be used as an email address. In general, name-based identifiers tend to be subject to some degree of expected change and/or reassignment,” so arguably the practice of changing ePPN when a user changes email address is less than best practice.</font></div><div><a href="https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonPrincipalName"><font face="Calibri" style="font-size: 14px;">https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonPrincipalName</font></a></div><div><br></div><font face="Calibri" style="font-size: 14px;">ePTID is defined as “persistent” ~ "<span style="background-color: rgb(255, 255, 255);">SHOULD be maintained</span><span style="background-color: rgb(255, 255, 255);">...</span><span style="background-color: rgb(255, 255, 255);">long enough to be useful as a key for consuming services.</span>”</font><div><a href="https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonTargetedID"><font face="Calibri" style="font-size: 14px;">https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonTargetedID</font></a></div><div><font face="Calibri" style="font-size: 14px;"><br></font></div><div><font face="Calibri" style="font-size: 14px;">ePTID is opaque and not necessarily human-friendly. You mention “several applications [and] SPs”; if you hope for correlation of identities between these applications, ePTID may not be what </font></div><div><font face="Calibri" style="font-size: 14px;">you want as the value will likely be different for different SPs.</font></div><div><font face="Calibri" style="font-size: 14px;"><br></font></div><div><font face="Calibri" style="font-size: 14px;"><br></font></div><div><font face="Calibri"><span style="background-color: rgb(255, 255, 255); font-size: 14px;"><br></span></font><div><div><font face="Calibri" style="font-size: 14px;">On Fri, 29 Aug 2014, at 13:59 , Ken Weiss <<a href="mailto:ken.weiss@ucop.edu">ken.weiss@ucop.edu</a>> wrote:</font></div><font face="Calibri" style="font-size: 14px;"><br class="Apple-interchange-newline"></font><blockquote type="cite"><font face="Calibri" style="font-size: 14px;">Hi,<br><br>I'm not sure if this is a question for this list or not. If I'm in the<br>wrong place, please direct me to the right place...<br><br>We have several applications sitting behind Shibboleth SPs that rely on<br>the EPPN to uniquely identify a user. One of the IDPs with which we<br>integrate just told me that they use the authenticated user's email<br>address as the EPPN. Because email addresses change frequently, so do the<br>EPPNs in this IDP. The IDP manager did mention, though, that they also use<br>the eduPersonTargetedID attribute, and that one is guaranteed to be both<br>unique and stable.<br><br>Is the eduPersonTargetedID at least as widely used as the EPPN? Is the<br>eduPersonTargetedID always guaranteed to be unique and stable? I know<br>eduPersonTargetedID is not part of the standard Research and Scholarship<br>category attribute set, so I'm somewhat hesitant to change our application<br>to rely on that, instead of EPPN.<br><br>Maybe what I really want to ask is this: What attribute do you recommend<br>using as a unique identifier for a Shibboleth-authenticated user?<br><br>--Ken<br><br>------------------------------------------------------------<br>Ken Weiss <a href="mailto:ken.weiss@ucop.edu">ken.weiss@ucop.edu</a><br>UC Office of the President 510-587-6311 (office)<br>California Digital Library 916-905-6933 (mobile)<br>UC Curation Center<br>415 20th Street, 4th Floor<br>Oakland, CA 94612<br><br>-- <br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></font></blockquote></div><br></div></body></html>