<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<font face="Helvetica, Arial, sans-serif">Referring to
<a class="moz-txt-link-freetext" href="http://software.internet2.edu/eduperson/internet2-mace-dir-eduperson-201602.html#eduPersonPrincipalName">http://software.internet2.edu/eduperson/internet2-mace-dir-eduperson-201602.html#eduPersonPrincipalName</a><br>
<br>
states: <br>
.....where the "scope" portion MUST be the administrative domain
of the identity system where the identifier was created and
assigned. <br>
</font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">.....</font>ePPN looks like
an email address but is not intended to be a person's published
email address or be used as an email address.<br>
<br>
<br>
<br>
I approach it that the @yyy.zzz for the mail attribute is an email
address domain and <a class="moz-txt-link-abbreviated" href="mailto:the@yyy.zzz">the@yyy.zzz</a> </font><font face="Helvetica,
Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">for
the </font></font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif"><font face="Helvetica,
Arial, sans-serif">eduPersonPrincipalName</font> attribute is
a DNS domain.<br>
<br>
Yes for many the actual value will look the same (mail =
<a class="moz-txt-link-abbreviated" href="mailto:lohrda@jmu.edu">lohrda@jmu.edu</a>) (</font></font><font face="Helvetica, Arial,
sans-serif"><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">eduPersonPrincipalName =
<a class="moz-txt-link-abbreviated" href="mailto:lohrda@jmu.edu">lohrda@jmu.edu</a>). But say you have two email domains, one for
employees (@yyy.zzz) and one for students</font>
(@students.yyy.zzz), then using the </font></font><br>
<font face="Helvetica, Arial, sans-serif"><font face="Helvetica,
Arial, sans-serif"><font face="Helvetica, Arial, sans-serif">eduPersonPrincipalName
value of a student's email address value will not be correct:<br>
<br>
</font></font></font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial, sans-serif"><font face="Helvetica,
Arial, sans-serif"><a class="moz-txt-link-abbreviated" href="mailto:user@yyy.zzz">user@yyy.zzz</a> (</font></font></font><font face="Helvetica, Arial, sans-serif"><font face="Helvetica, Arial,
sans-serif"><font face="Helvetica, Arial, sans-serif">eduPersonPrincipalName)
does not equal <a class="moz-txt-link-abbreviated" href="mailto:user@student.yyy.zzz">user@student.yyy.zzz</a> (mail).<br>
<br>
Don<br>
<br>
</font></font></font><font face="Helvetica, Arial, sans-serif"></font><br>
<div class="moz-cite-prefix">On 12/7/22 2:50 PM, Wigfall, Robert via
users wrote:<br>
</div>
<blockquote type="cite" cite="mid:MN2PR07MB7870E9ABCCFB0B1112C5686AC31A9@MN2PR07MB7870.namprd07.prod.outlook.com">
<pre class="moz-quote-pre" wrap="">CAUTION: This email originated from outside of JMU. Do not click links or open attachments unless you recognize the sender and know the content is safe.
________________________________
Hello -
We are considering changing our edupersonprincaplename attribute. We have migrated to a new IDP and seek to correct any attributes per the eduperson standards and specs on wiki.refeds.org.
The proposed change would result in the eppn being the users actual email. I realize the definition indicates eppn is not intended to be a person’s published email address, or to be used as an email address. I am just curious if any are using email address as eppn and if there are any repercussions of which we need to be aware?
Thanks for any input.
Robert Wigfall
INFORMATION TECHNOLOGY
SIU.EDU
--
For Consortium Member technical support, see <a class="moz-txt-link-freetext" href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!N6YHze6lT7thMl0!KUgFppfqsgRLtddnSJBYQeigsYZdhOFXm7Qo0phKdMQxVydSLLqcpkhlMycG9ZTvtgcEuZ2A8cef3-4f$">https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!N6YHze6lT7thMl0!KUgFppfqsgRLtddnSJBYQeigsYZdhOFXm7Qo0phKdMQxVydSLLqcpkhlMycG9ZTvtgcEuZ2A8cef3-4f$</a>
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>