Default Attribute Release Policy

By definition, a default attribute release policy specifies a set of attributes to be released to any SP. To be clear, not all IdPs have such a policy. For example, most (if not all) of the IdPs in the Hide From Discovery Category do not have a default attribute release policy. On the other hand, a discoverable IdP necessarily has a default attribute release policy since it responds to all authentication requests.

Like all IdPs, a discoverable IdP has an unspecified attribute release policy governed by local policy constraints, that is, an IdP’s attribute release policy is strictly a local decision. However, an IdP’s ability to successfully interoperate with all SPs is a shared responsibility that leads to an overall positive federated user experience, and so a reasonable default attribute release policy is the first step towards becoming a good federation participant. With the foregoing as a premise, this page discusses the technical and policy aspects of default attribute release.

Crafting a Default Policy

A deployer has a wide range of default policies from which to choose. For simplicity, consider the set of name identifiers separate from other user attributes. Note that the lists below are not exhaustive; they are intended to be illustrative only.

Default name identifiers:

1. SAML2 Transient NameID

2. SAML2 Persistent NameID (which is equivalent to the eduPersonTargetedID attribute)

Default user attributes:

1. eduPersonUniqueId

2. eduPersonTargetedID (which is equivalent to the SAML2 Persistent NameID)

3. eduPersonPrincipalName

4. the Essential Attribute Bundle

It is recommended that every IdP release a persistent, non-reassigned identifier to all SPs for some subset of the IdP's user population:

1. eduPersonUniqueId OR
2. eduPersonTargetedID OR
3. eduPersonPrincipalName (if non-reassigned)

Note that the SAML2 Persistent NameID and the eduPersonUniqueId attribute are non-reassigned by definition. The eduPersonPrincipalName attribute is permitted to be reassigned but there is data to suggest that as many as 75% of InCommon IdPs assert an eduPersonPrincipalName that is not reassigned. Even if your deployment of eduPersonPrincipalName is reassigned, it is better to release it to all SPs than to have no default attribute release policy at all.

Regardless of whether your deployment of eduPersonPrincipalName is reassigned or not, it is strongly RECOMMENDED that IdPs support the eduPersonUniqueId attribute. It is believed that the use of eduPersonUniqueId will increase and eventually overtake eduPersonPrincipalName as the identifier of choice (but time will tell).

Note that not all SPs need to receive the same default set of attributes. For example, SPs registered by InCommon might receive one set of attributes while other SPs might receive another. A single default attribute release policy avoids needless complication so consider that first.