Research & Scholarship Attribute Bundle
| Wiki Markup |
|---|
h2. Research & Scholarship Attribute Bundle {div:style=float:right;margin-left:1em;margin-bottom:1ex}{info}Configure your IdP to [release the R&S attribute bundle|Research and Scholarship Attribute Bundle Config] now!{info}{div} |
Identity
...
providers
...
are
...
encouraged
...
to
...
release
...
the
...
R&S
...
attribute
...
bundle
...
to
...
all
...
R&S
...
service
...
providers:
...
- Identifiers
eduPersonPrincipalNameeduPersonTargetedID
- Mail attribute
mail
- Person name attributes
displayNamegivenNamesn(surname)
- Authorization attribute
eduPersonScopedAffiliation
It is easy to configure a Shibboleth IdP to release the R&S attribute bundle to all R&S SPs. If, however, you are using SAML software that does not support entity attributes, consider releasing the Essential Attribute Bundle to all SPs instead.
| Note | ||
|---|---|---|
| ||
An identity provider (IdP) supports the Research & Scholarship (R&S) Category if, for some subset of the IdP's user population, the IdP releases a minimal subset of the R&S attribute bundle to R&S service providers without administrative involvement, either automatically or subject to user consent. |
| Anchor | ||||
|---|---|---|---|---|
|
Minimal Subset of the R&S Attribute Bundle
The following attributes constitute a minimal subset of the R&S attribute bundle:
eduPersonPrincipalNamemaildisplayNameOR (givenNameANDsn)
For the purposes of access control, a non-reassigned persistent identifier is REQUIRED. If your deployment of eduPersonPrincipalName is non-reassigned, it will suffice. Otherwise you MUST release eduPersonTargetedID (which is non-reassigned by definition) in addition to eduPersonPrincipalName. In any case, release of both identifiers is RECOMMENDED.
An Optimization
If a service provider lists any of the person name attributes in metadata, the identity provider MUST release some form of person name, either displayName or givenName + sn. Beyond that, an identity provider is NOT REQUIRED to release any attribute not listed in metadata.