This topic is for existing Research & Scholarship (R&S) IdP operators. All R&S SPs in the InCommon Federation now meet the requirements of the REFEDS R&S Entity Category specification and therefore every R&S SP has a multivalued R&S entity attribute in metadata. More importantly, InCommon will soon begin importing the metadata of R&S SPs from other federations, so now is the time for R&S IdP operators to begin thinking about their migration strategy to global R&S.
Basically, an existing R&S IdP operator has two options:
These two options are discussed in the sections below.
Contents
This section is for existing R&S IdPs that want to support global Research & Scholarship by releasing attributes to all R&S SPs, including R&S SPs in other federations.
To support R&S globally, an existing R&S IdP follows this simple 3-step process:
An IdP that releases attributes to all R&S SPs will be among the first group of InCommon IdPs whose metadata is exported to eduGAIN. |
Most of the Research & Scholarship (R&S) IdPs in the InCommon Federation are configured with a policy rule that releases attributes to R&S SPs tagged with the legacy incommon.org R&S entity attribute value:
<afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://id.incommon.org/category/research-and-scholarship"/> |
To support R&S globally, an R&S IdP should instead be configured with a policy that releases the R&S Attribute Bundle to all R&S SPs, including R&S SPs in other federations:
<afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://refeds.org/category/research-and-scholarship"/> <!-- for Shib IdP V3, use type saml:EntityAttributeExactMatch instead --> |
For more detailed information about configuring an IdP for R&S, consult the R&S Attribute Bundle Config topic.
To facilitate the migration process suggested by the previous configurations, all R&S SPs registered by InCommon now have a multivalued R&S entity attribute in metadata.
Important! For both SPs and IdPs, only the refeds.org R&S entity attribute value is exported to eduGAIN:
The legacy incommon.org R&S entity attribute value
is not exported to eduGAIN. Only the refeds.org R&S entity attribute value
is exported to eduGAIN! |
See the R&S Entity Metadata topic for details about entity attributes in metadata.
This section is for existing R&S IdPs that want to continue to release attributes to R&S SPs registered by InCommon.
Most of the Research & Scholarship (R&S) IdPs in the InCommon Federation are configured with a policy rule that releases attributes to R&S SPs tagged with the legacy incommon.org R&S entity attribute value:
<afp:PolicyRequirementRule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://id.incommon.org/category/research-and-scholarship"/> |
An instance of Shibboleth IdP V2 leverages the Registered By InCommon Category to retain its current attribute release policy without relying on the legacy InCommon R&S entity attribute value:
<afp:PolicyRequirementRule xsi:type="basic:AND"> <basic:Rule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://refeds.org/category/research-and-scholarship"/> <basic:Rule xsi:type="saml:AttributeRequesterEntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://id.incommon.org/category/registered-by-incommon"/> </afp:PolicyRequirementRule> |
An instance of Shibboleth IdP V3 leverages either the registered-by-incommon
entity attribute (as above) or the <mdrpi:RegistrationInfo>
element directly, as shown in the following example:
<afp:PolicyRequirementRule xsi:type="basic:AND"> <basic:Rule xsi:type="saml:EntityAttributeExactMatch" attributeName="http://macedir.org/entity-category" attributeValue="http://refeds.org/category/research-and-scholarship"/> <basic:Rule xsi:type="saml:RegistrationAuthority" registrars="https://incommon.org"/> </afp:PolicyRequirementRule> |
For more information about configuring an IdP for R&S, consult the R&S Attribute Bundle Config topic in the wiki.