The Incommon Federation wiki has moved.

Please visit the new InCommon Federation Library wiki for updated content. Remember to update your bookmarks.

Click in the link above if you are not automatically redirected in 15 seconds.



You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 15 Next »

User Interface Elements and Requested Attributes in SP Metadata

This page describes how an SP site administrator adds user interface elements and requested attributes to metadata. These elements are used by IdP implementations to enhance their user interfaces. See the section on software support for a complete list of supported applications.

In a nutshell, here's what you need to do:

  1. Port the attribute requirements listed in your POP to metadata
  2. Refactor the remaining sections of your POP into a Privacy Policy targeted at the user

Complete the above steps in reverse order. First publish your Privacy Policy to a permanent location on the web. Then complete the metadata update process outlined below.

The Relation Between your POP and the Privacy Policy

Since you only have one POP, it necessarily applies to all of your SP deployments. In that sense, the granularity of the POP is not sufficient for those sites supporting multiple SPs. On the other hand, your Privacy Policy—and everything else mentioned below—refers to a single SP deployment. Hence, you should repeat the steps below for each SP under your control.

Note: A Privacy Policy may be shared across SP deployments. Not all SPs have the same privacy requirements, however, so you should consider carefully the granularity that best fits your overall SP deployment.

For the time being, leave your POP where it is despite the fact that it can now be put entirely online. InCommon is reviewing the POP in light of these (and other) developments occurring within the Federation.

Updating your Metadata

Login to the metadata administrative interface as usual. Along the left hand side, click on the link "Service Provider Metadata Wizard," click "View, Edit, or Delete SP metadata," click "Edit," and then click "Add New User Interface Elements and Requested Attributes". A web form to enter the new elements will appear.

When you press "Save," both an <mdui:UIInfo> extension element and an <md:AttributeConsumingService> element (containing <md:RequestedAttribute> elements) are inserted into your metadata. From that point forward, you manage these elements the same as you would any other metadata element.

User Interface Elements

All of the input fields below except Display Name are optional for SPs.

Display Name

Typically, the value of the Display Name field will appear on login and error pages at the IdP, and also on the consent page. If the element does not exist in metadata, applications are required to fall back on the <md:OrganizationDisplayName> element, which typically does not reflect the service but rather the organization that runs the service. Such an organization may in fact run multiple SP services so the organization name is a poor choice to use on a user interface.

This element is required in InCommon metadata.

Description

A brief description (100 characters or less) of the service may be provided. On systems that support a pointing device (such as a mouse), the content of this input field will pop up when the user hovers over the Display Name.

This element is optional in InCommon metadata but SP operators are encouraged to supply this information.

Information URL

A link to a more comprehensive information page may be provided. This page should expand on the content of the Description field.

This element is optional in InCommon metadata but SP operators are encouraged to supply this information.

Privacy Statement URL

A link to the SP's Privacy Policy may be provided.

This element is optional in InCommon metadata but SP operators are strongly encouraged to supply this information.

Your Privacy Policy

The importance of a Privacy Policy can not be overstated. Users will be instructed to consult the SP's Privacy Policy, lack of which will cause some users to decline attribute release.

Logo URL

This element is optional but there are applications that can leverage this element in metadata so SP operators are encouraged to provide a link to a logo that meets the following requirements. For example, a consent interface may use a visual cue (i.e., a logo) instead of or in addition to the Display Name.

The actual size of the logo may vary. You will be asked to enter the actual width and height of the logo (in pixels). The application will select your logo (or not) based on the width and height entered into metadata.

Usable logos have the following characteristics:

  • the logo must be specified using an HTTPS URL
  • the logo should have a transparent background
  • the logo should have a landscape orientation (width > height)
  • the logo should have an aspect ratio between 4:3 and 16:9
  • the logo should have a minimum width of 100 pixels
  • the logo should have a minimum height of 75 pixels

Logos that meet the minimum height requirement can be scaled down by the application as needed.

Requested Attributes

Requested attributes are presented to the user on the consent page. At runtime, the user is asked whether or not the requested attributes should be released to the SP, so care should be taken to request only those attributes actually needed by the service.

At least one attribute is required. From the drop-down menu labeled Attribute Name, simply choose the desired attribute. If the chosen attribute is eduPersonAffiliation, eduPersonEntitlement, or eduPersonScopedAffiliation, an optional Attribute Values field will appear. Enter the requested attribute value(s) (or not, as the case may be). Repeat the input process for each requested attribute.

Once the Save button is pressed, two <md:RequestedAttribute> elements will be inserted into metadata for every attribute chosen from the drop-down menu. One of those attributes is a SAML1 attribute while the other is a SAML2 attribute. The IdP will automatically choose one or the other depending on the runtime protocol.

Software Support

Shibboleth IdP 2.3 (and later) and uApprove 2.2 (and later) support the <mdui:UIInfo> element in SP metadata. If you know of other software applications that support <mdui:UIInfo>, please share this information with the community.

In addition to the <mdui:UIInfo> element, uApprove 2.2 consumes the <md:AttributeConsumingService> element (containing <md:RequestedAttribute> elements) in SP metadata. The requested attributes in metadata are displayed to the user on the consent page.

#trackbackRdf ($trackbackUtils.getContentIdentifier($page) $page.title $trackbackUtils.getPingUrl($page))
  • No labels