Shibboleth Developers

["Scott Cantor" <>]

> This is not what I was referring to in my previous message, however. 
> Once the SP receives the authn assertion and the fully qualified
> username (or whatever persistent identifier is agreed upon) from the
> IdP, that attribute must correlate with a user known to the VLE.  Thus
> the VLE must recognize users by the same persistent identifier.  So
> let me stop and ask: how are accounts created in your particular VLE? 
> What is the source of the "usernames" known to your VLE?

EPPN? TargetedID? We already know how to do this type of thing. Using
unqualified usernames in databases is an example of how to create problems.
If your system already does, then you have a legacy issue no matter what,
but creating new systems like this is just asking for trouble.

-- Scott