Page History

...

Identity Providers

IdP Support for R&S

An IdP supports R&S if, for some subset of the IdP's user population, the IdP releases some a minimal subset of the R&S attribute bundle to R&S SPs without administrative involvement, either automatically or subject to user consent. A list of IdPs that are known believed to support R&S is maintained elsewhere in this wiki.

The following attributes constitute a minimal subset of the R&S attribute bundle:

• eduPersonPrincipalName OR eduPersonTargetedID
• mail
• displayName OR (givenName AND sn)

To facilitate unambiguous access control, the persistent identifier (eduPersonPrincipalName OR eduPersonTargetedID) MUST be non-reassigned. Recall that eduPersonTargetedID is non-reassigned by definition.

Deployment Options

To support R&S, an IdP has at least three options (in increasing order of deployment difficulty):

1. Release a fixed subset of the R&S bundle (or the R&S bundle itself) for to all SPs
2. Release a fixed subset of the R&S bundle (or the R&S bundle itself) for to all R&S SPs (leveraging an entity attribute in SP metadata)
3. Release a precise varying subset of the R&S bundle for to each R&S SP (depending on an SP-by-SP basis requested attributes in SP metadata)

The Shibboleth IdP software supports either of the first two options out-of-the-box. The latter option requires a special plugin at the Shibboleth IdP. No other IdP software is known to support entity attributes at this time.

...