InCommon SAML Subject Identifiers Deployment Guidance Working Group

["Morgan, Andrew J" <>]

That is correct - EPPN values are not suitable for subject-id values.

What guidance do we give to IDP operators that are currently releasing EPPN?  Assume they have already determined the value to release for subject-id.  Should they stop releasing EPPN and release subject-id instead or should there be a period of overlap when both values are released?  What about the access entity categories?

This discussion is not about migrating EPPN values into subject-id.  It is about how to start using subject-id and stop using EPPN and other identifiers.

Thanks,

Andy

---

From: Jones, Mark B <>
Sent: Friday, August 23, 2024 4:44 PM
To: IAM David Bantz <>; Morgan, Andrew J <>; <>
Subject: Re: Asynchronous work - IDP guidance

 

[This email originated from outside of OSU. Use caution with links and attachments.]

+1

---

From: <> on behalf of IAM David Bantz <>
Sent: Friday, August 23, 2024 6:28 PM
To: Morgan, Andrew J <>
Cc: <>
Subject: Re: Asynchronous work - IDP guidance

 

External: Increase caution when handling links and attachments.

I was surprised to read discussion of migration strategy from eduPersonPrincipalName to samlSubjectID.

My impression is that ePPN is generally name-based, thus not really persistent, thus inappropriate for samlSubjectID. 

David

On Fri, Aug 23, 2024 at 9:06 AM Morgan, Andrew J <> wrote:

Hi everyone,

During today's meeting, we started discussing implementation guidance for IDPs.  Please read the meeting notes (https://docs.google.com/document/d/1YINTg3Tvjdmx_2HpNs4pdFmL3iHYXGKZBefRxDm3QQ4/edit#heading=h.mrl26y9cootl) and help us develop actual positions and guidance on this topic.  For now, put this at the end of the working document (https://docs.google.com/document/d/1EOVPkPjCs0W6jGFrPwOq6_KMeACma__9WJ71CEeVfYU/edit) under the "Things to Ponder" heading.

See you next week!

Thanks,

Andy