This was added to support the RR use-case.

It's passed in the ApplicationOverride configs in the shibboleth2.xml config. It's indeed a priority chain:
 * shib will try the eppn attribute first,
 * if there is no such attribute the persistent-id attribute will be used,
 * otherwise it defaults to targeted-id

When we want to do user-resolving via authentication login IDs with RR we will want to make sure we use the same remote_user attribute chains as they do.