Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This document describes the SAML attributes and OIDC claims that are available to relying parties  connected to the OCRE GEANT SP Proxy. Attribute - claims marked as Mandatory will always be available to a relying party. Attribute - claims marked as Optional will be made available under certain circumstances. For example, some attributes - claims can be available only if the respective attributes - claims are released by the home Identity Provider of the user. Attributes - claims and values marked as Experimental might change or removed in the future, so relying parties should not rely on them, but use them only for experimental purposes.

...

Table of Contents
excludeList of Attributes - Claims

...

User Identifier

NameUser Identifier
Description

The  User Identifier is an opaque and non-revocable identifier (i.e. it cannot change over time). The User Identifier has a limit of 255 characters

SAML Attribute(s)

- urn:oasis:names:tc:SAML:attribute:subject-id

OIDC claim(s)sub (public)
OIDC claim locationThe claim is available in:

ID token
Userinfo endpoint
Introspection endpoint
OIDC scopeopenid
OriginAssigned to the user by the
OCRE
GEANT SP Proxy
ChangesNo
MultiplicitySingle-valued
AvailabilityMandatory
ExampleE413E5B2-1439-42DA-A7ED-
23444DDD0E5B@ocre
23444DDD0E5B@aai.
aai.
geant.org
Notes

The User Identifier and Username

“test@ocre.aai

“test@aai.geant.org” are test accounts reserved for testing and monitoring the proper functioning. The Relying parties should not authorise it to access any valuable resources.

Display Name

NameDisplay Name
Description

User’s name (firstname lastname).

SAML Attribute(s)

urn:oid:2.16.840.1.113730.3.1.241 (displayName)

OIDC claim(s)name
OIDC claim locationThe claim is available in:

 ID token
Userinfo endpoint
Introspection endpoint
OIDC scopeprofile
OriginProvided by the Identity Provider of the user
ChangesYes
MultiplicitySingle-valued
AvailabilityOptional
ExampleJack Dougherty
Notes


Given Name

NameGiven Name
Description

Name strings that are the part of a person's name that is not their surname (see RFC4519).

SAML Attribute(s)

urn:oid:2.5.4.42 (givenName)

OIDC claim(s)given_name
OIDC claim locationThe claim is available in:

 ID token
Userinfo endpoint
Introspection endpoint
OIDC scopeprofile
OriginProvided by the Identity Provider of the user
ChangesYes
Multiplicity

Single-valued

AvailabilityOptional
ExampleJack
Notes

In the specification of urn:oid:2.5.4.42 it is stated that the attribute supports multiple values, but the OIDC claim support only a single value. The Sevice will release a single value to both SAML and OIDC relying parties

Family Name

NameFamily Name
Description

Family name of the user

SAML Attribute(s)

urn:oid:2.5.4.4 (surname)

OIDC claim(s)family_name
OIDC claim locationThe claim is available in:

 ID token
Userinfo endpoint
Introspection endpoint
OIDC scopeprofile
OriginProvided by the Identity Provider of the user
ChangesYes
Multiplicity

Single-valued

AvailabilityOptional
ExampleDougherty
Notes

In the specification of urn:oid:2.5.4.4 it is stated that the attribute supports multiple values, but the OIDC claim support only a single value. The Service will release a single value to both SAML and OIDC relying parties

Email address

NameEmail address
Description

Email address of the user.

SAML Attribute(s)

urn:oid:0.9.2342.19200300.100.1.3 (email)

OIDC claim(s)email
OIDC claim locationThe claim is available in:

 ID token
Userinfo endpoint
Introspection endpoint
OIDC scopeemail
OriginProvided by the Identity Provider of the user
ChangesYes
Multiplicity

Single-valued

AvailabilityOptional
Examplejack.dougherty@example.com
Notes


Affiliation within Home Organization

NameAffiliation within Home Organization
Description

One or more home organisations (such as, universities, research institutions or private companies) this user is affiliated with. The syntax and semantics follows eduPersonScopedAffiliation attribute.

Following values are recommended for use to the left of the “@” sign:

  • Faculty

    The person is a researcher or teacher in their home organisation. 

    The exact interpretation is left to the home organization, but the intention is that the primary focus of the person in their home organisation is in research and/or education. 

    Note. This attribute value is for users in the academic sector

  • Industry-researcher

    The person is a researcher or teacher in their home organisation. 

    The exact interpretation is left to the home organisation, but the intention is that the primary focus of the person in their home organisation is in research and/or education. 

    Note. This attribute value is for users in the private sector.

  • Member

    Member is intended to include faculty, industry-researcher, staff, student and other persons with a full set of basic privileges that go with membership in the home organisation, as defined in eduPerson. 

    In contrast to faculty, among other things, this covers positions with managerial and service focus, such as service management or IT support.

  • Affiliate

    The affiliate value indicates that the holder has some definable affiliation to the home organisation NOT captured by any of faculty, industry-researcher, staff, student and/or member.

If a person has faculty or industry-researcher affiliation with a certain organisation, they have also the member affiliation. However, that does not apply in a reverse order. Furthermore, those persons who do not qualify to member have an affiliation of affiliate.

SAML Attribute(s)

urn:oid:1.3.6.1.4.1.25178.4.1.11 (voPesonExternalAffiliation)

OIDC claim(s)voperson_external_affiliation
OIDC claim locationThe claim is available in:

 ID token
Userinfo endpoint
☐ Introspection endpoint
OIDC scopevoperson_external_affiliation
OriginProvided by the Identity Provider of the user
ChangesYes
Multiplicity

Multi-valued

AvailabilityOptional
Examplefaculty@helsinki.fi
industry-researcher@zeiss.com
member@ebi.ac.uk
Notes

The Connected Services are not supposed to do SAML scope check to this attribute.

Affiliation with Research Communities

Groups

Name

Groups

DescriptionThis attribute describes the groups this user is a member of in their collaboration [AARC-G002].
SAML Attribute(s)

urn:oid:1.3.6.1.4.1.5923.1.1.1.7 (eduPersonEntitlement)

OIDC claim(s)eduperson_entitlement
OIDC claim locationThe claim is available in:

 ID token
Userinfo endpoint
☐ Introspection endpoint
OIDC scopeeduperson_entitlement
OriginProvided by the Identity Provider of the user
ChangesYes
Multiplicity

Multi-valued

AvailabilityOptional
Example

This is an example of user registered in eduTEAMS, who is member of the Hollywood VO and she in the writers group and the movies movies subgroup within the writers group.

Notes