...
| Attribute Description | Attribute Friendly Name | Attribute OID | Attribute Example Value |
|---|---|---|---|
Persistent, non-reassigned, non-targeted identifier; this is always scoped @lifescienceid.org | eduPersonUniqueId | urn:oid:1.3.6.1.4.1.5923.1.1.1.13 |
|
| Email address | mail | urn:oid:0.9.2342.19200300.100.1.3 | john.doe@example.org |
| Display name | displayName | urn:oid:2.16.840.1.113730.3.1.241 | John Doe |
| First name | givenName | urn:oid:2.5.4.42 | John |
| Family name | sn | urn:oid:2.5.4.4 | Doe |
| Assurance information | eduPersonAssurance | urn:oid:1.3.6.1.4.1.5923.1.1.1.11 | TBD |
| TBD | eduPersonScopedAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.9 | TBD |
One or more URIs (either URNs or URLs) that indicate rights to specific resources; URN values expressing group membership and role information use the urn:geant:lifescienceid.org:group namespace (see also AARC-JRA1.1A) | eduPersonEntitlement | urn:oid:1.3.6.1.4.1.5923.1.1.1.7 |
|
| One or more ORCID researcher identifiers | eduPersonOrcid | urn:oid:1.3.6.1.4.1.5923.1.1.1.16 | http://orcid.org/0000-0002-1825-0097 |
OIDC
OIDC Client Registration
LifeScience Authentication and Authorisation Infrastructure (LS-AAI) supports LifeScience community's OpenID Connect (OIDC) based clients or service providers. The providers are Web applications like SAML SPs. For the integration, the clients must be registered with OIDC authorisation server provided by the LS-AAI. The operators of the clients are required to provide OIDC client credentials (client id and secret) and redirect or callback URI for the successful registration.
Metadata Discovery Endpoint
The OIDC endpoints can be discovered under the following address (also called well-known URL):
https://oidc.pilot.lifescienceid.org/oauth2/.well-known/openid-configuration
Scopes and Claims (Attributes)
Scope in the LS-AAI defines what claims or user attributes the OIDC client can access. Following three standard scopes with corresponding claims are provided:
| Scope | Claim (User Attribute Name) | ||||||
|---|---|---|---|---|---|---|---|
| openid | sub | ||||||
| profile |
| ||||||