InCommon metadata support

["Cantor, Scott" <>]

On 2/14/14, 7:56 PM, "Andrew Morgan" 
<>
 wrote:
>
>Unfortunately, our central identity usernames do not match the vanity
>email addresses assigned in the @oregonstate.edu domain.  In fact, there
>are clashes between usernames and email addresses (that are not the same
>person).  We could still release EPPN as 
>"",
> but
>it would not be a valid email address.

An EPPN is not formally an email address. If you're saying none of your
email addresses is @oregonstate.edu, then there is at least no ambiguity.
If you're saying you have cases where such addresses exist, and even worse
that they may not actually belong to the person whose username is the
email alias, that would be a disaster.

It's also very bad if you reassign EPPNs.

You will still have problems integrating with many large vendors by using
EPPNs that are not email addresses, but those vendors often will accept or
even prefer email addresses as identifiers instead of EPPN, and email is
not a scoped attribute (and those vendors don't use Shibboleth and have no
filtering of scope in any case).

-- Scott