From fb95dfe49a820be1a4866f12170a2a42cfeb5b35 Mon Sep 17 00:00:00 2001
From: Ricardo van der Heijden
 <20791917+ricardovdheijden@users.noreply.github.com>
Date: Tue, 7 Jul 2026 16:18:00 +0200
Subject: [PATCH 1/2] #648 Adds variables for scoped identifier in eppn feature

---
 environments/template/group_vars/template.yml | 2 ++
 roles/myconext/templates/application.yml.j2   | 6 ++++++
 2 files changed, 8 insertions(+)

diff --git a/environments/template/group_vars/template.yml b/environments/template/group_vars/template.yml
index 121808078..54823c324 100644
--- a/environments/template/group_vars/template.yml
+++ b/environments/template/group_vars/template.yml
@@ -260,6 +260,8 @@ myconext:
   feature_dry_run_email_cron: true
   feature_enable_account_linking: true
   feature_use_app: true
+  feature_use_global_uid: true
+  feature_force_global_uid_entities: "dummy_non_existing_entity,playground_client"
   sms_api_url: "https://rest.spryngsms.com/v1/messages"
   sms_api_route: "default"
   sp_entity_id: https://engine.{{ base_domain }}/authentication/sp/metadata
diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2
index 9e2af3722..7d3d7649c 100644
--- a/roles/myconext/templates/application.yml.j2
+++ b/roles/myconext/templates/application.yml.j2
@@ -160,6 +160,12 @@ feature:
   enable_account_linking: {{ myconext.feature_enable_account_linking }}
   # Set to true to show the app login option
   use_app: {{ myconext.feature_use_app }}
+  # When true (default) release the global uid in the uid and eduPersonPrincipalName SAML attributes.
+  # When false, release the per-SP targeted eduID instead.
+  use_global_uid: {{ myconext.feature_use_global_uid }}
+  # SP entityIds that always receive the global uid in the uid and eduPersonPrincipalName SAML attributes,
+  # even when use_global_uid is false.
+  force_global_uid_entities: "{{ myconext.feature_force_global_uid_entities }}"
 
 default_affiliate_email_domain: eduid.nl
 

From 97a7ebcda37b323f048ea0a4cf767277401f48fd Mon Sep 17 00:00:00 2001
From: Ricardo van der Heijden
 <20791917+ricardovdheijden@users.noreply.github.com>
Date: Wed, 5 Aug 2026 15:00:57 +0200
Subject: [PATCH 2/2] #648 Changes feature_force_global_uid_entities from comma
 separated list to a YAML array

---
 environments/template/group_vars/template.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/environments/template/group_vars/template.yml b/environments/template/group_vars/template.yml
index 54823c324..d73e3202d 100644
--- a/environments/template/group_vars/template.yml
+++ b/environments/template/group_vars/template.yml
@@ -261,7 +261,9 @@ myconext:
   feature_enable_account_linking: true
   feature_use_app: true
   feature_use_global_uid: true
-  feature_force_global_uid_entities: "dummy_non_existing_entity,playground_client"
+  feature_force_global_uid_entities:
+    - dummy_non_existing_entity
+    - playground_client
   sms_api_url: "https://rest.spryngsms.com/v1/messages"
   sms_api_route: "default"
   sp_entity_id: https://engine.{{ base_domain }}/authentication/sp/metadata