InCommon Technical Discussions

[Tom Scavo <>]

On Thu, Jun 8, 2017 at 7:36 AM, Scott Koranda 
<>
 wrote:
>
> The VOs I have been working with have so far relied on ePPN and not
> ePTID or any other targeted identifiers. The primary reason is the need
> to "see" the same user at multiple SPs operated by the VO.
>
> Somewhat ironically this is changing now as the VOs are preparing to
> deploy IdP/SP proxies in production and present a single SP to the
> federation(s). The reason is for better interoperability because of IdPs
> that will only send targeted identifiers.

That is good to hear! In that case, can we shift the discussion from
pairwise identifiers to default attribute release policy?

It's looking more and more like OIDC gets this right. AFAIK, all OIDC
transactions require the IdP to release the 'sub' claim: a persistent,
non-reassigned identifier. The IdP may choose to release a pairwise
version of the 'sub' claim but it is not required to do so nor can the
SP compel the IdP to release a pairwise identifier (or otherwise).

Eventually the Shibboleth IdP (and other implementations) will support
the OIDC protocol but in the meantime why not align with OIDC and
recommend that IdPs release a persistent, non-reassigned identifier to
all SPs? That would require nontrivial effort but I think it has
higher probability of success than other proposals that have been
floated lately.

Tom