Research and Scholarship Entity Category

The GEANT AAI Service supports the Research and Scholarship (R&S) Entity Category. As such, GEANT AAI Service expects to receive the R&S attribute bundle from IdPs in eduGAIN supporting the R&S Entity Category.

Code of Conduct Entity Category

As a service that meets the requirements for and supports the entity category of Code of Conduct, the service specifically declares the attributes it requires.

Attribute TypeAttributeRequirementExplanation
User Identifier

subject-id

Mandatory (at least one)

GEANT AAI Service and the services connected through GEANT AAI Service require to uniquely identify users. Without a unique identifier, it is not possible to distinguish two different users between each other.

As a service that supports Sirtfi, it is required that it is able to uniquely identify users.

1 The eduPersonPrincipalName can be used only if one of the following conditions are met:

i) the IdP supports the R&S Enitity Category,

ii) the eduPersonAssurance attribute is also released and it has a value of https://refeds.org/assurance/ID/eppn-unique-no-reassign,

iii) the federation in which the IdP has registered has a policy that prohibits the reassignment of the value of the eduPersonPrincipalName attribute

pairwise-id

eduPersonPrincipalName1

eduPersonTargetedID

eduPersonUniqueId


Name

cn

Mandatory  (at least one)

GEANT AAI Service and the services connected through GEANT AAI Service expect to receive the name of the user.

For example, when a user applies for a new project or for membership membership to an existing project, the managers need to be able to recognise who the applicant is.

displayName


sn + givenName

Mail

mail

Mandatory

GEANT AAI Service needs to be able to contact the user regarding the status of their account. In addition, many of the services connected through GEANT AAI Service expect the email of the user in order to be able contact the user about service related matters.

OrganizationschacHomeOrganizationOptional

Access to many of the services connected through GEANT AAI Service relies on authorising users based on their home organisation.

EntitlementseduPersonEntitlementOptional

Service specific entitlements that may be required in order to access specific services.


Depending on which protocol the IdP is using, SAML or OIDC, attributes need to be released in the following format, respectively:

  • SAML Attribute Names

SAML Attributes MUST be sent using urn:oasis:names:tc:SAML:2.0:attrname-format:uri NameFormat. Below is the list of the canonical names of the SAML attributes:

SAML Attribute NameSAML Attribute Friendly Name
urn:oasis:names:tc:SAML:attribute:subject-idsubject-id
urn:oasis:names:tc:SAML:attribute:pairwise-idpairwise-id
urn:oid:0.9.2342.19200300.100.1.3 email
urn:oid:1.3.6.1.4.1.25178.1.2.9schacHomeOrganization
urn:oid:1.3.6.1.4.1.5923.1.1.1.6eduPersonPrincipalName
urn:oid:1.3.6.1.4.1.5923.1.1.1.10

eduPersonTargetedID

urn:oid:1.3.6.1.4.1.5923.1.1.1.13eduPersonUniqueId
urn:oid:2.5.4.3cn
urn:oid:2.5.4.4 surname
urn:oid:2.5.4.42givenName


  • OIDC Claims and Scopes
OIDC ClaimScope
subject-idopenid
emailemail
nameprofile
given_nameprofile
family_nameprofile
entitlementsentitlements
schac_home_organizationschac_home_organization


  • No labels