A non-opaque username that uniquely identifies the subject.

Single valued, scoped to home organisation to ensure it is globally unique within the research and education sector. eduPerson allows reassignment, but SAFIRE IdPs may not do this. Should not be assumed to be a valid email address (see mail).

The scope portion must exactly match one of the <shibmd:Scope> elements in the identity provider’s metadata.

• eduPerson
• IdP Requirements