This guide is intended to give you some ideas about how to generate an eduPersonPrincipalName (ePPN) for users.


You can find a video introduction to ePPN on Skolfederation's YouTube channel here (in Swedish).


eduPersonPrincipalName is defined in eduPerson 1.0, OID:
A scoped identifier for a person. It should be represented in the form "user@scope" where 'user' is a name-based identifier for the person and where the "scope" portion MUST be the administrative domain of the identity system where the identifier was created and assigned. Each value of 'scope' defines a namespace within which the assigned identifiers MUST be unique. Given this rule, if two eduPersonPrincipalName (ePPN) values are the same at a given point in time, they refer to the same person. There must be one and only one "@" sign in valid values of eduPersonPrincipalName.


In Skolfederation, ePPN must:

  • be properly scoped with a domain name owned by the Member Organization.
  • uniquely represent a single user.
  • never be reassigned.

One way to achieve this is, for example, to use a Base36 alphanumeric number that is stored as a string and padded with zeros on the left for sorting. ePPN is incremented for every new user. If we use a length of 6 (36^6), that gives us 2,176,782,336 ePPNs before overflow occurs. Either append the scope, an owned domain, before storing the ePPN, or do it later, e.g., in the IdP.

Example Scripts

This example shows how you can add the attribute to users by utilizing scripts. The script is built so that it should be possible to run it with a scheduler.

ePPN for Google Workspace on Github
ePPN for Microsoft AD on Github

  • No labels


You are not logged in. Any changes you make will be marked as anonymous. You may want to Log In if you already have an account.