Some SPs use eduPersonPrincipalName (EPPN) as a user identifier instead of the more usual targetedID. This page covers how to release it.
What is EPPN?
If you find and read the eduPerson specification (don't) it is essentially described as a scoped, name based identifier for a person in the form user@scope that is unique to that user (but might be recycled). What that generally means though is that it looks like an email address, and must use the same domain (after the @) as your domain or organisation's scope as seen in the organisation summary. If you are a large organisation, your scope may have differences to represent different parts, so whilst it may look like an email, it may or may not match up.
The next steps depend on the type of accounts you use:
If you use OpenAthens accounts
If you have a field on your accounts that would be suitable if it had your scope tacked on the end, then you can use that - e.g. staff / student number - and then simply release that under an alias. You can't use an email field because the system will automatically add your scope for this particular attribute and that will leave you with something along the lines of name@emaildoman.com@scope.net... which won't work. Anything with a space in it is bad too, but for different reasons.
How to alias an attribute for EPPN
What we need to do is release the attribute you're using under a different target name. I'll assume Staff/student number for this example.
- Go to Attribute release (Preferences > Attribute release)
- Click the button to add a policy
- Search and select the resource you want to release it to
- Click on the edit button (right side of the resource's window)
- Click on Staff/student number to set it as releasable
- Click on the advanced button and go to the attribute aliases section
- Set:
- From the dropdown select
Identifier (this is the target name for Staff/student number - you can see it if you hover over the attribute in the selection section) - In the box to the right enter:
urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (this is the target name for EPPN)
- Click on Done and then on Save changes.
You will need to ensure the field is populated on relevant accounts - if it's more than a few accounts then the Download data and Bulk upload functions can help.
If you do not have an existing field with suitable data you can either add data to an existing field and proceed as above, or create a new field specific to EPPN
How to use a new attribute for EPPN
First we set up the attribute
- Go to the schema editor (Preferences > Schema editor)
- Drag a text attribute to the main window
- Set:
- Target:
urn:oid:1.3.6.1.4.1.5923.1.1.1.6 - Display name: EPPN
- Required: depends on if you need this for all users or just some of them
- Releasable: Yes
- Reportable: If you like
- Multi-line: No
- Click on Done and then on Save changes.
Then we set it as releasable
- Go to Attribute release (Preferences > Attribute release)
- Click the button to add a policy
- Search and select the resource you want to release it to
- Click on the edit button (right side of the resource's window)
- Click on EPPN to set it as releasable
- Click on Done and then on Save changes.
You will also have to populate the field on the relevant accounts - if it's more than a few accounts then the Bulk upload function can help.
If you use local accounts
If your local directory is from Microsoft such as ActiveDirectory or Azure, there will already be a userPrincipalName (UPN) attribute that looks like it should be useful, but there's a very strong possibility that it is formed as firstname.lastname@yourdomain.com which not only might raise privacy or data protection concerns in your jurisdiction but won't work because our system automatically adds the relevant scope to attributes that should be scoped (it would end up looking something like firstname.lastname@yourdomain.com@scope.net).
The source attribute you want is one that is unique to the user and ideally pseudonymous - objectSId and objectGuid are great choices but anything that is unique to the user and doesn't include an @ character or a space is good enough. If there's a suitable thing you're already sending, you can reuse that if you like.
How to do it with local accounts
First we set up the attribute (or it won't be releasable)
- Go to the schema editor (Preferences > Schema editor)
- Drag a text attribute to the main window
- Set:
- Target:
urn:oid:1.3.6.1.4.1.5923.1.1.1.6 - Display name: EPPN
- Required: No
- Releasable: Yes
- Reportable: If you like
- Multi-line: No
- Click on Done and then on Save changes.
Next we set up the mapping from your connection
- Confirm with your IT team the name of the attribute that holds the data (it'll be case sensitive)
- Go to your connection (Management > Connections > your connection)
- Go to the Attributes tab and add a mapping rule
- Set:
- Target name:
urn:oid:1.3.6.1.4.1.5923.1.1.1.6 (if it's not available as a typeahead you may need to go back to the schema editor) - Source attribute / claim: the value you got for your IT team
- Display name: EPPN
- Click on Done and then on Save changes
Finally we set it as releasable
- Go to Attribute release (Preferences > Attribute release)
- Click the button to add a policy
- Search and select the resource you want to release it to
- Click on the edit button (right side of the resource's window)
- Click on EPPN to set it as releasable
- Click on Done and then on Save changes.
When you test this for the first time you will need to sign out of OpenAthens and back in again so that the system picks up the new attribute mapping.
