The Incommon Federation wiki has moved.

Please visit the new InCommon Federation Library wiki for updated content. Remember to update your bookmarks.

Click in the link above if you are not automatically redirected in 15 seconds.



You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 29 Next »

Deployment Considerations for the R&S Category

Service Providers

It is important that the implementation and deployment of all InCommon services facilitate initial on-boarding processes to avoid operational and technical impediments to adoption, as described in Recommended Practices for InCommon Participants.

More specifically, R&S services generally have a broad user community, often including people who do not have a close relationship with the Service Provider, or whose IdP operators do not have a close relationship with the Service Provider. For this reason, R&S Service Providers are encouraged to consider the following guidelines:

  • The R&S category is most useful to those services that do not require out-of-band negotiation with IdPs.
  • The service should request a subset of R&S Category Attributes, and furthermore, the service should request only those attributes it absolutely needs. (See the section on R&S Category Attributes for details.)
  • The SP should fully support SAML V2.0 Web Browser SSO (see the SP Endpoints wiki page).
  • The SP should provide a complete set of User Interface Elements in metadata. In particular, a Privacy Statement and a Logo are highly recommended.
  • In addition to the Technical and Administrative Contacts in Metadata required of all SPs, a Security contact should also be provided (once that option becomes available).
  • The SP should strive to provide a good, overall federated user experience. In particular, the SP should intelligently handle errors involving the release of requested attributes. InCommon now operates a centralized Error Handling Service that SPs can use to report errors to users.

Identity Providers

An IdP supports R&S if the IdP releases some subset of the R&S attribute bundle to R&S SPs without administrative involvement, either automatically or subject to user consent. To support R&S, an IdP has at least two options:

  1. Release a fixed subset of the R&S attribute bundle (or the R&S bundle itself) to all R&S SPs
  2. Release a dynamic subset of the R&S attribute bundle to each R&S SP on an SP-by-SP basis

Sites are strongly encouraged to configure their IdPs to support R&S.

If a site decides that it wants to block release of attributes for certain community members (e.g., students who have opted out under FERPA), IdP operators could create an additional attribute release policy rule to enforce this decision. IdP addons that provide end-user control over attribute release (such as uApprove) may also be used.

  File Modified
No files shared here yet.
#trackbackRdf ($trackbackUtils.getContentIdentifier($page) $page.title $trackbackUtils.getPingUrl($page))
  • No labels