17. RefWorks can optionally receive an eduPersonScopedAffiliation (ePSA) for each user, which we would use to authorize the user. Typical authorized values would be "student", "faculty", and "staff", though some institutions simply use "member" for all and only users authorized to use RefWorks. An ePSA isn't necessary, if the IdP only releases unique identifiers for users who are authorized to use RefWorks. We leave it to the IdP to decide whether to release the ePSA or not.