| Note | ||
|---|---|---|
| ||
Note that this page has been deprecated. The information it contains is no longer current. InCommon no longer certifies IdPs that release R&S attributes only locally, although some IdPs do still retain that legacy certification, so this document has been retained to illuminate the differences between global and InCommon-only R&S certifications. All IdPs are encouraged to certify for global R&S; see How to Apply for the Research and Scholarship (R&S) Entity Category for more information. |
Migrating an IdP to the Global Research & Scholarship Category
This topic is for operators of existing Research & Scholarship (R&S) IdPs, that is, IdPs that have declared their support for the Research & Scholarship category.
All R&S SPs in the registered by InCommon Federation now meet the requirements of the international REFEDS Research & Scholarship Entity Category specification and therefore all R&S SPs have a multivalued R&S entity attribute in InCommon metadata. More importantly, InCommon will begin importing imports the metadata of R&S SPs from other federations as soon as possible, so now is the time for . Consequently, R&S IdP operators to begin thinking about should plan their migration strategy to global R&S.
...
- Release attributes to all R&S SPs, including R&S SPs in other federations
- Release attributes to R&S SPs registered by InCommon only
These two mutually exclusive options are discussed in the following sections below.
| Note | ||
|---|---|---|
| ||
| Neither of the The actions documented here are required actionsNOT REQUIRED. If you choose to take no action, nothing will break. We do, however, strongly encourage you to perform exactly one of the actions documented on this page. |
...
| Table of Contents | ||
|---|---|---|
|
The R&S Migration Process
| Div | ||
|---|---|---|
| ||
|
To support the R&S category, either globally or locally, the operator of an existing R&S IdP follows this simple 3-step process:
- Review the authoritative REFEDS Research & Scholarship Entity Category specification
- The requirements for an R&S SP have changed slightly (a gap analysis has been prepared for your convenience)
- The requirements for an R&S IdP have not changed
- Configure your IdP to release attributes to R&S SPs, either globally or locally (see subsequent sections)
- Declare your IdP's ability to support R&S by submitting a short form
Once the R&S declaration form has been submitted, your metadata will be updated to reflect your IdP's attribute release policy.
| Note | ||
|---|---|---|
| ||
| Since all R&S SPs have a multivalued R&S entity attribute in InCommon metadata (for backwards compatibility), R&S IdP operators can migrate to global R&S at any time. |
Reconfiguring Your IdP
| Warning | ||
|---|---|---|
| ||
| As of July 31, 2016, Shibboleth IdP V2 is unsupported software. You should upgrade to Shibboleth IdP V3 as soon as possible! |
Use of the Legacy R&S Tag
If you support R&S today, and you have not already performed the migration steps documented on this wiki page, your IdP is probably likely configured with a policy rule that releases attributes to R&S SPs tagged with the legacy incommon.org R&S entity attribute valuetag, something like this:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://id.incommon.org/category/research-and-scholarship"/> |
Use Continued use of the incommon.org R&S tag in this manner is discouraged.
| Warning | ||
|---|---|---|
| ||
| Use of the legacy incommon.org R&S tag to configure attribute release policy at the IdP is deprecated. Eventually this tag will be removed from all SP metadata but (although a timeline for doing so has not yet been determined). |
Thus all R&S IdPs should be reconfigured to not rely on the legacy incommon.org R&S tag. Although we have no immediate plans to remove that tag from SP metadata, we reserve the right to do so in the future. We will of course let you know in advance if and when this happens but in the meantime we ask that you remove the legacy incommon.org R&S tag from your IdP configuration. Doing so now prevents you from having to do so at a later ontime.
...
| Anchor | ||||
|---|---|---|---|---|
|
Configuring an IdP to Release Attributes Globally
This section is for existing R&S IdPs that want to to support global Research & Scholarship by by releasing attributes to to all R R&S SPs, including R&S SPs in other federations.
Supporting the REFEDS R&S Entity Category
| Div | ||
|---|---|---|
| ||
|
To support R&S globally, the operator of an existing R&S IdP follows this simple 3-step process:
...
- The requirements for an R&S SP have changed slightly (a gap analysis has been prepared for your convenience)
- The requirements for an R&S IdP have not changed
...
| Tip | ||
|---|---|---|
| ||
| If your IdP releases the Essential Attribute Bundle to all SPs (not just R&S SPs), and your deployment of eduPersonPrincipalName is non-reassigned, no further configuration is required. Please declare |
...
| your IdP's ability to support global R&S |
...
| now. |
| Note |
|---|
| An IdP that releases attributes to all R&S SPs will be among the first group of InCommon IdPs whose metadata is exported to eduGAIN. |
Configuring an IdP to Release Attributes Globally
To support R&S globally, an R&S IdP should be configured with a policy rule that releases the R&S Attribute Bundle to all R&S SPs, including R&S SPs in other federations. An instance of Shibboleth IdP V2 may be configured as follows:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/> |
Similarly, an An instance of Shibboleth IdP V3 may be is configured as followssimilarly:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<afp:PolicyRequirementRule xsi:type="saml:EntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/>
|
Note that the above configurations recognize the refeds.org R&S entity attribute value. For more detailed information about configuring an IdP for R&S, consult the R&S Attribute Bundle IdP Config topic.
Important! For both SPs and IdPs, only the refeds.org R&S entity attribute value is exported to eduGAIN:
| Note | ||
|---|---|---|
| ||
The legacy incommon.org R&S entity attribute value
is not exported to eduGAIN. Only the refeds.org R&S entity attribute value
is exported to eduGAIN! |
See the R&S Entity Metadata topic for details about entity attributes in metadata.
...
| Anchor | ||||
|---|---|---|---|---|
|
Configuring an IdP to Release Attributes Locally
This section is for existing R&S IdPs that want to continue to release attributes to R&S SPs registered by InCommon only.
Configuring an IdP to Release Attributes Locally
| Tip | ||
|---|---|---|
| ||
If your IdP releases the Essential Attribute Bundle to all SPs registered by InCommon (not just R&S SPs registered by InCommon), and your deployment of eduPersonPrincipalName is non-reassigned, no further configuration is required. |
An IdP that supports R&S locally is configured To support R&S locally, an R&S IdP should be configured with a policy rule that releases the R&S Attribute Bundle to R&S SPs registered by InCommon only. To do this without relying on the legacy incommon.org R&S tag (a practice that is deprecated), an instance of Shibboleth IdP V2 leverages the Registered By InCommon Category as follows:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<afp:PolicyRequirementRule xsi:type="basic:AND">
<basic:Rule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/>
<basic:Rule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://id.incommon.org/category/registered-by-incommon"/>
</afp:PolicyRequirementRule> |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
<afp:PolicyRequirementRule xsi:type="basic:AND">
<basic:Rule xsi:type="saml:EntityAttributeExactMatch"
attributeName="http://macedir.org/entity-category"
attributeValue="http://refeds.org/category/research-and-scholarship"/>
<basic:Rule xsi:type="saml:RegistrationAuthority"
registrars="https://incommon.org"/>
</afp:PolicyRequirementRule> |
...
| Tip | ||
|---|---|---|
| ||
Note that the registrars XML attribute in the preceding example takes a space-separated list of registrar IDs |
...
| , which is most flexible. You could easily expand your attribute release policy by adding other registrar IDs to the list. |
For more information about configuring an IdP for R&S, consult the R&S Attribute Bundle IdP Config topic in the wiki.
Frequently Asked Questions
What do you mean by “multivalued R&S entity attribute?”
Please visit the R&S Entity Metadata wiki page. There you will find an example of a multivalued R&S entity attribute for R&S SPs.
Why do all R&S SPs have a multivalued R&S entity attribute in metadata?
Every R&S SP has a multivalued R&S entity attribute in metadata so that R&S IdPs can migrate to global R&S at any time without loss of interoperability.
Under what conditions will an IdP receive a multivalued R&S entity attribute in metadata?
Eventually the legacy incommon.org R&S tag in SP metadata will be removed.
Why is it necessary to remove the legacy incommon.org R&S tag from SP metadata?
The Research & Scholarship category is now an international standard. The legacy incommon.org R&S tag is only relevant inside the InCommon Federation. In order to interoperate with international partners, the legacy incommon.org R&S tag must be replaced with the new Under no circumstances will an IdP receive a multivalued R&S entity attribute. An IdP receives the refeds.org R&S tag if and only if it releases attributes to , which is the only R&S entity attribute value recognized by R&E federations worldwide.
When will the legacy incommon.org R&S tag be removed from SP metadata?
We have no definite plans to remove the legacy incommon.org R&S tag from SP metadata. We will monitor the progress of the Research & Scholarship category in the InCommon Federation and make a determination at a later time. In the meantime, it is RECOMMENDED that all IdPs remove all references to the legacy all R&S SPs globally. If, OTOH, an IdP releases attributes to R&S SPs registered by InCommon only, it will receive the incommon.org R&S tag from their configurations.Be aware, however, that the
| Note | ||
|---|---|---|
| ||
The legacy incommon.org R&S |
...
entity attribute value
in SP metadata is not exported to eduGAIN. Only the refeds.org R&S entity attribute value
in SP metadata is exported to eduGAIN! That is, R&S SPs exported to eduGAIN have a single-valued R&S entity attribute in metadata (since backwards compatibility is not an issue outside of the InCommon Federation). |
When will the incommon.org R&S tag be removed from IdP metadata?
As long as there are IdPs that want to restrict attribute release to R&S SPs registered by InCommon, the legacy incommon.org R&S tag will remain in IdP metadata. Note well: , it will not contain an R&S entity attribute at all. From a global perspective, you do do not support support R&S unless you recognize the refeds.org R&S entity attribute value in SP metadata.
When should I migrate to global R&S, that is, when should I
...
reconfigure my IdP to release attributes to all R&S SPs globally?
You can reconfigure your IdP whenever you’re ready. Today there are no global R&S SPs in InCommon metadata but soon there will be. If you are certain you want to support global R&S, then by all means reconfigure your IdP now.
If I reconfigure my IdP to recognize the refeds.org R&S tag, will my IdP start releasing attributes to SPs outside InCommon?
At this moment, all the entities in the InCommon metadata aggregate are registered by InCommon, so the only R&S SPs in the aggregate are InCommon R&S SPs. Within the next few months, however, InCommon will begin importing R&S SPs from other federations via eduGAIN. When that happens, if If your IdP recognizes the refeds.org R&S entity attribute valuetag in SP metadata, it will automatically release attributes to all R&S SPs, including R&S SPs from other federations. That’s precisely what it means to support global R&S.
I don’t want to release attributes to R&S SPs from other federations. How do I prevent that from happening?
If you don’t want to release attributes to R&S SPs from other federations, don’t change your attribute release policy to recognize the refeds.org R&S entity attribute value. Simply continue to recognize the legacy incommon.org R&S entity attribute value as you do now, or better yet, reconfigure your IdP to release attributes to R&S SPs registered by InCommon without relying on the legacy incommon.org R&S tag.
If I don’t
...
release attributes to global R&S SPs,
...
why do I have to touch my IdP config at all?
You are not required to touch your IdP config, at least not at this time. The suggested actions documented here are RECOMMENDED but NOT REQUIRED.
That said, we encourage you to reconfigure your IdP as documented. If you do, and we decide to remove the legacy incommon.org R&S tag from SP metadata at some later timedate, you’ll be all set. In any case, we won’t do anything without giving everyone ample lead time.
Why is it necessary to remove the legacy incommon.org R&S tag from SP metadata?
The Research & Scholarship category is now an international standard. The legacy incommon.org R&S entity attribute value is only relevant inside the InCommon Federation. In order to interoperate with international partners, the legacy incommon.org R&S tag must be replaced with the new refeds.org R&S entity attribute value, which is the only R&S entity attribute value recognized by R&E federations worldwide.
When will the legacy incommon.org R&S tag be removed from SP metadata?
We have no definite plans to remove the legacy incommon.org R&S tag from SP metadata. We will monitor the progress of the Research & Scholarship category in the InCommon Federation and make a determination at a later time. In the meantime, it is RECOMMENDED that all IdPs remove all references to the legacy incommon.org R&S tag from their configurations.
When will the legacy incommon.org R&S tag be removed from IdP metadata?
As long as there are IdPs that want to restrict attribute release to R&S SPs registered by InCommon, the legacy incommon.org R&S tag will remain in IdP metadata.