Deployment Considerations for R and S

Deployment Considerations for the R&S Category

Service Providers

It is important that the deployment of all InCommon services facilitate initial on-boarding processes to avoid operational and technical impediments to adoption, as described in Recommended Practices for InCommon Participants.

More specifically, R&S services generally have a broad user community, often including people who do not have a close relationship with the Service Provider, or whose IdP operators do not have a close relationship with the Service Provider. For this reason, R&S Service Providers are encouraged to consider the following guidelines:

• The R&S category is most useful to those services that do not require out-of-band negotiation with IdPs.
• The service should request a subset of R&S Category Attributes, and furthermore, the service should request only those attributes it absolutely needs. (See the section on R&S Category Attributes for details.)
• The SP should fully support SAML V2.0 Web Browser SSO (see the SP Endpoints wiki page).
• The SP should provide a complete set of User Interface Elements in metadata. In particular, a Privacy Statement and a Logo are highly recommended.
• In addition to the technical and administrative Contacts in Metadata required of all SPs, a Security contact should also be provided (once that option becomes available).
• The SP should strive to provide a good, overall federated user experience. In particular, the SP should intelligently handle errors involving the release of attributes.

Identity Providers

An IdP supports R&S if the IdP releases some subset of the R&S attribute bundle to R&S SPs without administrative involvement, either automatically or subject to user consent. To support R&S, an IdP has at least three options (in increasing order of deployment difficulty):

1. Release a fixed subset of the R&S bundle (or the R&S bundle itself) for all SPs
2. Release a fixed subset of the R&S bundle (or the R&S bundle itself) for all R&S SPs
3. Release a precise subset of the R&S bundle for each R&S SP (on an SP-by-SP basis)

The Shibboleth IdP software supports either of the first two options out-of-the-box. The latter option requires a special plugin at the Shibboleth IdP. No other IdP software is known to support entity attributes at this time.

The R&S Category is the first of many such categories. Soon there will be multiple categories, for both SPs and IdPs, with each category having its own entity attribute value. Each supported category requires a software configuration similar to the R&S configuration.

The use of entity attributes (as opposed to entity IDs) has a significantly reduced administrative burden at the IdP. As the number of categories increases, however, the number of configurations increases as well. Is there an even higher level of abstraction that further simplifies the administration of attributes? Yes, an IdP can release directory information to all SPs, not just R&S SPs. Such a configuration can simultaneously satisfy the attribute requirements of multiple categories.

Many campuses expose directory information via their public web site. Although the policy associated with directory information varies from campus to campus, it’s not unreasonable to expect that some campuses will choose to expose this very same directory information via a SAML interface. There should be little discussion or controversy over releasing directory information for faculty, researchers, and staff since directory information is already public information.

If a site decides that it wants to block release of attributes for certain community members (e.g., students who have opted out under FERPA), IdP operators could create an additional attribute release policy rule to enforce this decision. IdP addons that provide end-user control over attribute release (such as uApprove) may also be used.