...
Div | ||
---|---|---|
| ||
|
Identity providers are encouraged to release the R&S attribute bundle to all R&S service providers:
...
It is easy to configure a Shibboleth IdP to release the R&S attribute bundle to all R&S SPs. If, however, you are using SAML software that does not support entity attributes, consider releasing the Essential Attribute Bundle to all SPs instead.
...
For the purposes of access control, a non-reassigned persistent identifier is REQUIRED. If your deployment of eduPersonPrincipalName
is non-reassigned, it will suffice. Otherwise you MUST release eduPersonTargetedID
(which is non-reassigned by definition) in addition to eduPersonPrincipalName
. In any case, release of both identifiers is RECOMMENDED.
An Optimization
A sufficiently capable IdP deployment can optimize attribute release based on the <md:RequestedAttribute>
elements in SP metadata:
- If a service provider lists the
eduPersonPrincipalName
attribute in metadata, and the IdP's deployment ofeduPersonPrincipalName
can be reassigned, then the IdP MUST release botheduPersonPrincipalName
andeduPersonTargetedID
to the SP regardless of whethereduPersonTargetedID
is listed in metadata. - If a service provider lists any of the person name attributes in metadata, the identity provider MUST release some form of person name, either
displayName
orgivenName
+sn
.
Beyond the two special cases noted above Beyond that, an identity provider is NOT REQUIRED to release any attribute not listed in metadata.