You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 4 Next »

Attributes Requested From IdPs in eduGAIN


Research and Scholarship Entity Category

The MyAccessID IAM Service supports the Research and Scholarship (R&S) Entity Category. As such, MyAccessID expectes to receive the R&S attribute bundle from IdP support the R&S Entity Category

Code of Conduct Entity Category

As a service that meets the requirements for and supports the entity category of Code of Conduct, the service specifically declares the attributes required to use the service.

Attribute TypeAttributeRequirementExplanation
User Identifier

subject-id

Mandatory. At least one

The services requires to uniquely identify users for authorization purposes. Without some a unique identifier, it is impossible to distinguish two different users between each other.

As a service that supports Sirtfi, it is required that it is able to uniquely identify users.

pairwise-id

eduPersonPrincipalName1

eduPersonTargetedID

eduPersonUniqueId

Level of AssuranceeduPersonAssuranceOptional

Access to the resources connected through MyAccessID will be dominantly supported by identites coming from the IdPs from the R&E sector and eduGAIN.

Best-fit and natural is to use the Assurance Framework that originated as collaborative work of R&E federations - the REFEDS Assurance suite https://wiki.refeds.org/display/ASS.

To insure identifier uniqueness:

To insure sufficient identity proofing and credential issuance, renewal, and replacement:

Level of Assurance information is planned to become mandatory in 2022


Name

cn

Mandatory. At least one

MyAccessID and the services connected through MyAccessID expect to receive the name of the user.

For example, when a user applies for a new project or for membership membership to an existing project, the managers need to be able to recognise who the applicant is.

displayName


sn + givenName

Mail

mail

Mandatory

MyAccessID needs to be able to contact the user regarding the status of their account. In addition, many of the services connected through MyAccessID expect the email of the user in order to be able contact the user about service related matters.

Affiliation

eduPersonScopedAffiliation

Mandatory

Access to many of the resources connected through MyAccessID relies on authorising users based on the affiliation of their members with their home organisation.

OrganizationschacHomeOrganizationOptional

Access to many of the service connected through MyAccessID relies on authorising users based on their home organisation.

1 The eduPersonPrincipalName can be used only if one of the following conditions are met: i) the IdP supports the R&S Enitity Category, ii) the eduPersonAssurance attribute is also released and it has a value of https://refeds.org/assurance/ID/eppn-unique-no-reassign, iii) the federation in which the IdP has registered has a policy that prohibits the reassignment of the value of the eduPersonPrincipalName attribute

Depending on which protocol the IdP is using, SAML or OIDC, attributes need to be released in the following format, respectively.

SAML Attribute Names

SAML Attributes MUST be sent using urn:oasis:names:tc:SAML:2.0:attrname-format:uri NameFormat. Below is the list of the canonical names of the SAML attributes:

SAML Attribute NameSAML Attribute Friendly Name
urn:oasis:names:tc:SAML:attribute:subject-idsubject-id
urn:oasis:names:tc:SAML:attribute:pairwise-idpairwise-id
urn:oid:0.9.2342.19200300.100.1.3 email
urn:oid:1.3.6.1.4.1.25178.1.2.9schacHomeOrganization
urn:oid:1.3.6.1.4.1.25178.4.1.6 voPersonID
urn:oid:1.3.6.1.4.1.25178.4.1.11 voPersonExternalAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.6eduPersonPrincipalName

urn:oid:1.3.6.1.4.1.5923.1.1.1.9

eduPersonScopedAffiliation

urn:oid:1.3.6.1.4.1.5923.1.1.1.10

eduPersonTargetedID

urn:oid:1.3.6.1.4.1.5923.1.1.1.11eduPersonAssurance
urn:oid:1.3.6.1.4.1.5923.1.1.1.13eduPersonUniqueId
urn:oid:2.5.4.3cn
urn:oid:2.5.4.4 surname
urn:oid:2.5.4.42givenName

OIDC Claim Names

OIDC ClaimScope
subject-idprofile
emailprofile
nameprofile
given_nameprofile
family_nameprofile
voperson_idaarc
eduperson_entitlementaarc

eduperson_scoped_affiliation

aarc
voperson_external_affiliationaarc
eduperson_assuranceaarc
schac_home_organization
  • No labels