OptionalemailThe person's email address, for events whose subject is an email. Compared without case.
OptionalexpiresWhen the application's session ends anyway; the index forgets it then.
OptionalidpThe identity provider's session id: the assertion's SessionIndex.
The application's own session id (its cookie's session, its database row).
OptionalpersonThe person's subject at the identity provider (e.g. urn:uuid:…), or undefined if the assertion did not carry it.
What one of the application's sessions is known by, read from the WS-Federation sign-in that started it.