Page History

This page shows how to configure a Shibboleth IdP to release the Essential Attribute Bundle.

Contents:

Release the Essential Attribute Bundle to Any SP

...

It is straightforward to configure a Shibboleth IdP to release directory information the Essential Attribute Bundle to any SP:

Code Block
language xml xml title Release the Essential Attribute Bundle to Any SP
<afp:AttributeFilterPolicy <AttributeFilterPolicy id="releaseToAnyonereleaseEssentialAttributesToAnySP"> <PolicyRequirementRule<afp:PolicyRequirementRule xsi:type="basic:ANY"/> <AttributeRule <afp:AttributeRule attributeID="eduPersonPrincipalName"> <PermitValueRule<afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule> <AttributeRule<afp:AttributeRule attributeID="email"> <PermitValueRule<afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule> <AttributeRule<afp:AttributeRule attributeID="displayName"> <PermitValueRule<afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule> <AttributeRule<afp:AttributeRule attributeID="givenName"> <PermitValueRule<afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule> <AttributeRule<afp:AttributeRule attributeID="surNamesurname"> <PermitValueRule<afp:PermitValueRule xsi:type="basic:ANY"/> </afp:AttributeRule> </afp:AttributeFilterPolicy>

To release some other set of directory information, simply customize the above example to match your policy

To restrict attribute release to SPs in the InCommon Federation, replace the <PolicyRequirementRule> above with the following rule:

Note
title An Important Consequence of Releasing the Essential Attribute Bundle
If your deployment of eduPersonPrincipalName is non-reassigned, the above attribute release policy supports the Research & Scholarship Category as a side effect, without further configuration. If your deployment of eduPersonPrincipalName is reassigned, simply add the eduPersonTargetedID attribute to the above attribute release policy to meet the minimal requirements of the Research & Scholarship Category.

For Shib IdP v2.4.0 (and higher), an optimization is possible. The following configuration releases an attribute in the Essential Attribute Bundle if and only if that attribute is called out in SP metadata:

Code Block
language xml title Release the Essential Attribute Bundle to Any SP Only If Requested
<afp:AttributeFilterPolicy id="releaseEssentialAttributesToAnySPIfRequested"> <afp:PolicyRequirementRule xsi:type="basic:ANY"/> <afp:AttributeRule attributeID="eduPersonPrincipalName"> <afp:PermitValueRule xsi:type="saml:AttributeInMetadata" onlyIfRequired="false"/> </afp:AttributeRule> <afp:AttributeRule attributeID="email"> <afp:PermitValueRule xsi:type="saml:AttributeInMetadata" onlyIfRequired="false"/> </afp:AttributeRule> <afp:AttributeRule attributeID="displayName"> <afp:PermitValueRule xsi:type="saml:AttributeInMetadata" onlyIfRequired="false"/> </afp:AttributeRule> <afp:AttributeRule attributeID="givenName"> <afp:PermitValueRule xsi:type="saml:AttributeInMetadata" onlyIfRequired="false"/> </afp:AttributeRule> <afp:AttributeRule attributeID="surname"> <afp:PermitValueRule
Code Block
xml	xml	<PolicyRequirementRule xsi:type="saml:AttributeRequesterInEntityGroup" groupID="urn:mace:incommon"/>

...

AttributeInMetadata" onlyIfRequired="false"/> </afp:AttributeRule> </afp:AttributeFilterPolicy>

Release the Essential Attribute Bundle to SPs Registered by InCommon

The following pair of policy rules release attributes to SPs registered by InCommon only. These policies are based on the following extension element in InCommon metadata:

<md:Extensions xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi">
  <mdrpi:RegistrationInfo registrationAuthority="https://incommon.org"/>
</md:Extensions>

The value of the registrationAuthority XML attribute is the registrar's ID. Every metadata registrar has a globally unique ID. For example, the InCommon registrar has the ID shown in the previous example, namely, "https://incommon.org".

For Shib IdP v3.0.0 and higher

For Shibboleth IdP V3, release attributes to SPs registered by InCommon as follows:

<afp:PolicyRequirementRule xsi:type="saml:RegistrationAuthority"
    registrars="https://incommon.org"/>

For Shib IdPs prior to v3.0.0

<afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
    attributeName="http://macedir.org/entity-category"
    attributeValue="http://id.incommon.org/category/registered-by-incommon"/>