Relax username requirements or consider using email addresses instead

[ctgraham]

What is driving the requirement that "The username must contain only lowercase letters, numbers, and hyphens/underscores."?

With Shibboleth authentication, the best practice username would be a scoped attribute, eg. user@institution-scope (usually this is just an email address).

Are there any known dependencies that will break if we loosen the username validation?

[asmecher]

No, nothing should depend on the username having specific content. FWIW, we might also reconsider our separation of usernames and emails; I've fought against this before but I'll concede that I find that approach useful.

[asmecher]

(See essentially the same proposals at #4053)