...
| Code Block |
|---|
| language | xml |
|---|
| title | A Shib IdP config that releases the R&S bundle to ALL R&S SPs |
|---|
|
<!-- for Shibboleth IdP V3.2.0 or later -->
<AttributeFilterPolicy id="releaseRandSAttributeBundle">
<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/>
<!-- a fixed subset of the Research & Scholarship Attribute Bundle -->
<!-- release of ePPN is REQUIRED -->
<AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<!-- if your deployment of ePPN is non-reassigned, release of ePTID is OPTIONAL -->
<AttributeRule attributeID="eduPersonTargetedID">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<!-- release of email is REQUIRED -->
<AttributeRule attributeID="email">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<!-- either displayName or (givenName and sn) is REQUIRED but all three are RECOMMENDED -->
<AttributeRule attributeID="displayName">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="givenName">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="surname">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<!-- release of ePSA is OPTIONAL -->
<AttributeRule attributeID="eduPersonScopedAffiliation">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
</AttributeFilterPolicy> |
...
Configure an IdP to Release R&S Attributes Locally
An IdP that supports R&S locally is configured with a policy rule that releases the R&S Attribute Bundle to R&S SPs registered by InCommon only. To do this, an instance of Shibboleth IdP V3 leverages the Registered By InCommon Category and/or MD-RPI Elements as shown in the following pair of examples:
| Code Block |
|---|
| language | xml |
|---|
| title | Example 1: Releasing attributes to R&S SPs registered by InCommon |
|---|
|
<!-- for Shibboleth IdP V3.2.0 or later -->
<!-- policy relies on two entity attributes -->
<PolicyRequirementRule xsi:type="AND">
<Rule xsi:type="EntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/>
<Rule xsi:type="EntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://id.incommon.org/category/registered-by-incommon"/>
</PolicyRequirementRule> |
| Code Block |
|---|
| language | xml |
|---|
| title | Example 2: Releasing attributes to R&S SPs registered by InCommon |
|---|
|
<!-- for Shibboleth IdP V3.2.0 or later -->
<!-- policy relies on an entity attribute and the RegistrationInfo element -->
<PolicyRequirementRule xsi:type="AND">
<Rule xsi:type="EntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/>
<Rule xsi:type="RegistrationAuthority" registrars="https://incommon.org"/>
</PolicyRequirementRule> |
Note that the registrars XML attribute takes a space-separated list of registrar IDs and therefore the previous configuration is more flexible.