Automatically fetch or remigrate alumni users to alumni email accounts.

[dlareau]

Right now alumni can still log in using their andrew accounts and the server sends mail to *@andrew.cmu.edu, but that email no longer exists. We get the proper information on a shib sign in to indicate whether or not a user is an alumni, and for alumni users we should move them to *@alumni.cmu.edu.

[timparenti]

Perhaps a flow more along the lines of: If a user that previously had an Andrew entitlement now has an Alumni entitlement instead, and their preferred email address ends in @(andrew.)?cmu.edu, clear out their old email address and prompt them for a new one.

(And maybe just ask all users to confirm their preferred email upon joining a new hunt, anyway.)

[sam-yeom]

This would also be helpful for the staff in determining whether a participant is currently affiliated with CMU. For the Spring 2020 hunt, we had to email all members of the top-finishing teams to determine whether they are eligible for prizes.

[dlareau]

I will note you will still have to email teams, as last time I checked even many cmu students didn't end up using the CMU login for authentication (for reasons I can never understand). There will also be cases (such as myself and Tim here) who have full working @andrew.cmu.edu accounts but are staff members not students, as there is no different suffix for staff members.

[timparenti]

Although prize eligibility is separate from this technical issue, the affiliation attribute from Shibboleth might help with that. (But as you say, visibility into eligibility will be limited, since I don't think you want to go the route of disallowing and/or auto-federating local account signups that use a federated email.)