Versions Compared

Old Version 167

changes.mady.by.user André Klaver

Saved on

compared with

New Version 215

changes.mady.by.user Teun Fransen

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This page will list all the SAML2 attributes that SURFconext and their Identity Providers have to offer. An attribute is a characteristic that describes a user. It is a 'name:value' pair. The attributes included in the SAML assertion correspond to certain attributes a service provider needs to work properly. In general they are needed to:

  • Convey user information from the Identity provider or IdP to the service provider
  • Create an account for the user at the service provider
  • Authorize specific services at the service provider

Now, when a user logs in to a Service Provider, SURFconext sends a SAML assertion to the Service Provider via the browser of the user, that contains a:

  • User identifier. Al services receive these and are either a configurable Transient or Persistent NameID.

  • and Additional attributes. These are optional and differ per Service.


Note

SURFconext's SAML2 implementation adheres to the SAML2int standard 0.2.1.

The header on the link above states that work on saml2int has moved to Kantara Initiative. Until further notice, the SAML2int standard SURFconext adheres to remains at 0.2.1.

Note
titleContent provider?

For content providers, SURFconext (in consultation with the partnership of the Dutch university libraries and the Koninklijke Bibliotheek (UKB), Hogeschoolbibliotheken (SHB)) applies a separate attribute release policy. The following are allowed:

  • Persistent or Transient NameID
  • schacHomeOrganization
  • eduPersonAffiliation

Read our blog for more information (Dutch)

Info

Before you start digging into the theoretical stuff on this page, you might want to start with our 'best practice' page for an introduction to and how attributes are best used.

Table of Contents

User identifiers

The user's identity is transmitted in the form of the NameID element. Every IdP must supply a NameID, but for privacy reasons SURFconext will generate a new one, which is duplicated in the attribute eduPersonTargetedID.

To identify a user the Service Provider must use the NameID or eduPersonTargetedID. The NameID is guaranteed to be stable for a fixed user, except in the case of transient identifiers. SURFconext will generate a NameID for each new user. It is unique for the user and specific to the SP, so SP's cannot correlate their received NameID's between each other. There are two types of NameIDs:

  • urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
    A persistent NameID contains a unique string identifying the user for this SP and is persisting over multiple sessions.
  • urn:oasis:names:tc:SAML:2.0:nameid-format:transient
    A transient NameID contains a unique string identifying the user for this SP during the session. If the user logs in again, a new transient identifier will be generated.

Warning
titleRemark

The NameID and eduPersonTargetedID, which is basically a copy of the NameID, is unlikely to change and very privacy aware but can change when service providers or identity provider make critical changes. This can cause user profiles for services to be lost. The NameID, as used in the SAML assertion to a service provider when loggin' on, is generated using the uid, schacHomeOrganization, the Entity ID of the service provider together with a secret that uses a SHA algorithm. Institutions or services that are in production and change one of these attributes, will cause a new NameID and eduPersonTargetedID to be generated by SURFconext when doing so. This can cause loss of access to profiles at services. We will notify identity providers and service providers when we see a change in one of these attributes to prevent user data being lost.

Changing attributes

As an Identity Provider it is important to realize that changing attributes in production on SURFconext in any way can have an impact on services users have access to. Attributes that you offer to SURFconext are used to create profiles, and data is often linked to them. Changing an attribute in any way can have unwanted results like users that are no longer able to access their valuable data. An example could be to modify the way you fill the email address (amongst others). For example: changing 'student.123456@university.nl' to 'john.doe@university.nl'. Do you plan to do this or do you start a project where this is the case? Contact us and send an email to support@surfconext.nl.

Useful links

  • Table with attributes we recommend our institutions to release: https://wiki.surfnet.nl/display/surfconextdev/Vereiste+attributen
  • Profile Page https://profile.surfconext.nl/ , showing what attributes are released by your IdP to SURFconext
  • For new IdP's or for IdP's that upgrade their environment: system administrators will at some point be asked to share the metadata of their account for analyses. When asked, visit this page and click the 'Mail to SURFconext' button. We will get back to you when we have judged the submitted metadata.This page will also show you the attributes shared and their values.

Attribute schemas

A schema is an abstract representation of an object's characteristics and relationship to other objects.

SURFconext supports two attribute schemas:

  • urn:oid schema (SAML2.0 compliant) 
  • urn schema (SAML1.1 compliant) 

Both can be used to convey the same information (except for the NameID, which is only available in the urn:oid schema). By default SURFconext will provide attributes in both schemas as part of the assertion. However it is not recommended to mix the use of the schemas.

Attribute overview

SURFconext supports relaying of the following attributes:

Friendly name

Attribute name

Example

ID

SAML NameID element

Info

See for the attribute best practice: Attribute best practice

When a user logs in to a Service Provider, SURFconext sends a SAML assertion to the Service Provider, containing:

  • user identifier (transient/persistent NameID)

  • additional attributes (optional)

Note

SURFconext's SAML2 implementation adheres to the SAML2int standard 0.2.1.

In this section we will show you which attributes SURFconext and their Identity Providers have to offer.

Table of Contents

User identifiers

The user's identity is transmitted in the form of the NameID element. Every IdP must supply a NameID, but for privacy reasons SURFconext will generate a new one, which is duplicated in the attribute eduPersonTargetedID.

To identify a user the Service Provider must use the NameID or eduPersonTargetedID. The NameID is guaranteed to be stable for a fixed user, except in the case of transient identifiers. SURFconext will generate a NameID for each new user. It is unique for the user and specific to the SP, so SP's cannot correlate their received NameID's between each other. There are two types of NameIDs:

...

Warning
titleRemark

The NameID and eduPersonTargetedID, which is basically a copy of the NameID, is unlikely to change and very privacy aware but can change when service providers or identity provider make critical changes . This can cause user profiles for services to be lost. The NameID, as used in the SAML assertion to a service provider when loggin' on, is generated using the uid, schacHomeOrganization, the Entity ID of the service provider together with a secret that uses a SHA algorithm. Institutions or services that are in production and change one of these attributes, will cause a new NameID and eduPersonTargetedID to be generated by SURFconext when doing so. This can cause loss of access to profiles at services. We will notify identity providers and service providers when we see a change in one of these attributes to prevent user data being lost.

Useful links

If you have an account at an institution you can get information about attributes shared with SURFconext by visiting our profile page. This page gives you insight in which personal data, provided by your institution via SURFconext, has been forwarded to which service and what they look like. For new IdP's or for IdP's that upgrade their environment, system administrators will at some point be asked to share the metadata of their account for analyses. When asked, visit this page and click the 'Mail to SURFconext' button. We will get back to you when we have judged the submitted metadata.This page will also show you the attributes shared and their values.

Attribute schemas

A schema is an abstract representation of an object's characteristics and relationship to other objects.

SURFconext supports two attribute schemas:

  • urn:oid schema (SAML2.0 compliant) 
  • urn schema (SAML1.1 compliant) 

Both can be used to convey the same information (except for the NameID, which is only available in the urn:oid schema). By default SURFconext will provide attributes in both schemas as part of the assertion. However it is not recommended to mix the use of the schemas.

Attribute overview

SURFconext supported relaying of the following attributes:

Friendly name

Attribute name

Definition

Data type

Example

ID

(NameID)
urn:mace:dir:attribute-def:eduPersonTargetedID
urn:oid:1.3.6.1.4.1.5923.1.1.1.10

eduPerson (1)

UTF8 string
(unbounded)

bd09168cf0c2e675b2def0ade6f50b7d4bb4aae

Surname

urn:mace:dir:attribute-def:sn
urn:oid:2.5.4.4

X.520

UTF8 string
(unbounded)

Vermeegen
孝慈

Given name
urn:mace:dir:attribute-def:givenNameeduPersonTargetedID
urn:oid:21.53.4.42

X.520

6.1.4.1.5923.1.1.1.10

bd09168cf0c2e675b2def0ade6f50b7d4bb4aae

Surname

UTF8 string
(unbounded)

Mërgim Lukáš
Þrúður

Common name

urn:mace:dir:attribute-def:cnsn
urn:oid:2.5.4.34

X.520

UTF8 String
(unbounded)

Doe

Vermeegen
孝慈

Given name or first

Prof.dr. Mërgim Lukáš Vermeegen
加来 千代, PhD.

Display name

urn:mace:dir:attribute-def:displayNamegivenName
urn:oid:2.165.840.1.113730.3.1.2414.42

John

Mërgim Lukáš

Þrúður

Common name or Full Name

urn:mace:dir:attribute-def:cn
urn:oid:2.5.4.3

John Doe

RFC2798

UTF8 String
(unbounded)

Prof.dr. Mërgim L. Lukáš Vermeegen

加来 千代, PhD.

Email addressDisplay name

urn:mace:dir:attribute-def:maildisplayName
urn:oid:02.16.9840.23421.19200300113730.1003.1.3241

Dr. John Doe

Prof.dr. Mërgim L. Vermeegen

加来 千代, PhD.

Email address

urn:mace:dir:attribute-def:mail
urn:oid:0.9.2342.19200300.100.1.3

RFC4524

RFC-5322 address
(max 256 chars)

m.l.vermeegen@university.example.org

maarten.'t.hart@uniharderwijk.nl 

"very.unusual.@.but valid.nonetheless"@example.com

mlv@[IPv6:2001:db8::1234:4321]

Organization

urn:mace:terena.org:attribute-def:schacHomeOrganization
urn:oid:1.3.6.1.4.1.25178.1.2.9

Schac

RFC-1035 domain string

example.nl

something.example.org  

Organization Type

urn:mace:terena.org:attribute-def:schacHomeOrganizationType
urn:oid:1.3.6.1.4.1.25178.1.2.10

Schac

RFC-2141 URN
see Schac standard  

urn:mace:terena.org:schac:homeOrganizationType:int:university

urn:mace:terena.org:schac:homeOrganizationType:es:opi

Employee/student number

urn:schac:attribute-def:schacPersonalUniqueCode
urn:oid:1.3.6.1.4.1.25178.1.2.14

Schac

RFC-2141 URN
see SURFnet registry 

urn:schac:personalUniqueCode:nl:local:example.edu:employeeid:x12-3456

urn:schac:personalUniqueCode:nl:local:example.nl:studentid:s1234567

Affiliation

urn:mace:dir:attribute-def:eduPersonAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.1

eduPerson (1)

Enum type (UTF8 String)

employeeemployee, student, faculty, member, affiliate, pre-student(staff is deprecated; library-walk-in, alum are not allowed)

Scoped affiliationurn:mace:dir:attribute-def:eduPersonScopedAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.9		eduPerson (1)UTF8 String user@domain

student@uniharderwijk.nl

employee@uniharderwijk.nl

Entitlement

urn:mace:dir:attribute-def:eduPersonEntitlement
urn:oid:1.3.6.1.4.1.5923.1.1.1.7

eduPerson (1)

RFC-2141 URN
Multi-valued

to be determined per service (see Standardized values for eduPersonEntitlement)

PrincipalName

urn:mace:dir:attribute-def:eduPersonPrincipalName
urn:oid:1.3.6.1.4.1.5923.1.1.1.6

eduPerson (1)

UTF8 String user@scope

piet.jønsen@example.edu

not.a@vålîd.émail.addreß

isMemberOf

urn:mace:dir:attribute-def:isMemberOf
urn:oid:1.3.6.1.4.1.5923.1.5.1.1

eduMember

RFC-2141 URN Multi-valued

urn:collab:org:surf.nl

urn:collab:org:clarin.org

uid

urn:mace:dir:attribute-def:uid
urn:oid:0.9.2342.19200300.100.1.1

RFC4519

UTF8 String
(max 256 chars)

s9603145

flåp@example.s9603145
flåp@example.edu

preferredLanguage

urn:mace:dir:attribute-def:preferredLanguage
urn:oid:2.16.840.1.113730.3.1.39

RFC2798
BCP47

List of BCP47 language tags

nl

nl, en-gb;q=0.8, en;q=0.7

ORCID

urn:mace:dir:attribute-def:eduPersonORCID

urn:oid:1.3.6.1.4.1.5923.1.1.1.16

eduPerson (1)

URL registered

with ORCID.org

http://orcid.org/0000-0002-1825-0097

Note that not all identity providers might make all attributes available.

(1) eduPerson Object Class Specification (201602): http://software.internet2.edu/eduperson/internet2-mace-dir-eduperson-201602.html

Warning
titleMinimum requirements for IdP's connecting to SURFconext

There is a minimum amount of attributes to supply when you connect your IdP to SURFconext. Not supplying the attributes urn:mace:dir:attribute-def:uid and urn:mace:terena.org:attribute-def:schacHomeOrganization will cause a fatal error because those are needed to generate the NameID. Your IdP cannot be connected to SURFconext without these. Not supplying the attributes urn:mace:dir:attribute-def:displayName and urn:mace:dir:attribute-def:mail will cause a warning. A lot of services depend on these. The above mentioned are the bare minimum and will probably result in services not being able to connect to your institution. As a rule of thumb, supply the attributes as depicted on this page or those depicted in the configuration manuals on the page (Dutch) 'Handleidingen en Richtlijnen'.

Info
titleDepricated Attributes

SURFconext considers the attributes nlEduPersonOrgUnit, nlEduPersonStudyBranch and nlStudielinkNummer deprecated. When you register a new IdP or SP at SURFconext, these attributes will not be allowed for use with SURFconext. Existing IdP's and SP can use these attributes until further notice.

Detailed attribute descriptions

...

See User identifiers.

...

urn:mace

...

urn:mace:dir:attribute-def:sn

...

urn:oid

...

urn:oid:2.5.4.4

...

Multiplicity

...

single-valued

...

Assurance

urn:mace:dir:attribute-def:eduPersonAssurance

urn:oid:1.3.6.1.4.1.5923.1.1.1.11

https://refeds.org/assurance/ID/unique
ECK ID

urn:mace:surf.nl:attribute-def:eckid

https://ketenid.nl/spv1/eacf3765ad342...cf3a11fe9cab2365f95da3e9965501f7c98e
(Attribute made shorter for readability)
SURF CRM IDurn:mace:surf.nl:attribute-def:surf-crm-idad93daef-0911-e511-80d0-005056956c1a
MS AuthnMethodsReferenceshttp://schemas.microsoft.com/claims/authnmethodsreferencesurn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
http://schemas.microsoft.com/claims/multipleauthn

OrganizationalUnitName

urn:mace:dir:attribute-def:ou
urn:oid:2.5.4.11

ICT Services
Geesteswetenschappen
Facilitair

eduidurn:mace:eduid.nl:1.1658b6b41-7c13-431d-b3b4-663e9077c24c
f4c9afe4-b9e1-42bb-92b8-047ac8711e29

Note that not all identity providers might make all attributes available.

(1) eduPerson Object Class Specification (201602): https://wiki.refeds.org/pages/viewpage.action?pageId=44957738

Info
titleDepricated Attributes

SURFconext considers the attributes nlEduPersonOrgUnit, nlEduPersonStudyBranch and nlStudielinkNummer deprecated. When you register a new SP at SURFconext, these attributes will not be allowed for use with SURFconext. Existing IdP's and SP can use these attributes until further notice.

Detailed attribute descriptions

Anchor
id
id
ID

See User identifiers.

Anchor
sn
sn
Surname

...

Description

...

The surname of a person (including any words such as “van”, “de”, “von” etc.) used for Personalization; this can be a combination of existing attributes.

...

Notes

...

urn:mace

urn:mace:dir:attribute-def:givenNamesn

urn:oid

urn:oid:2.5.4.424

Multiplicity

single-valued

Data typeUTF8 string (unbounded)

DescriptionGiven name, also known as a first name, forename or Christian name / “name known by”; combinations of title, initials, and “name known by” are possible

The surname of a person (including any words such as “van”, “de”, “von” etc.) used for Personalization; this can be a combination of existing attributes.

Examples

Jan Klaassen
Mërgim K. Lukáš 
Þrúður

Vermeegen 
孝慈

Notes


Anchor

...

givenName

...

givenName

...

Given name

urn:mace

urn:mace:dir:attribute-def:

cn

givenName

urn:oid

urn:oid:2.5.4.

3

42

Multiplicity

multi

single-valued

Data typeUTF8
string 
string (unbounded)

Description

Full name

Given name, also known as a first name, forename or Christian name / “name known by”; combinations of title, initials, and “name known by” are possible.

Examples

Jan Klaassen
Mërgim K. Lukáš 
Þrúður

Notes


Anchor
cn
cn
Common name

urn:mace

urn:mace:dir:attribute-def:cn

urn:oid

urn:oid:2.5.4.3

Multiplicity

multi-valued

Data typeUTF8 string 
(unbounded)

Description

Full name.

ExamplesProf.dr. Mërgim Lukáš Vermeegen 
加来 千代, PhD.

Notes

For example, a typical name of a person

Prof.dr. Mërgim Lukáš Vermeegen 
加来 千代, PhD.

Notes

For example, a typical name of a person in an English-speaking country comprises a personal title (e.g. Mr., Ms., Rd, Professor, Sir, Lord), a first name, middle name(s), last name, generation qualifier (if any, e.g. Jr.) and decorations and awards (if any, e.g. CBE).

...

urn:mace

urn:mace:terena.org:attribute-def:schacHomeOrganization

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.9

Multiplicity

single-valued

Data typeRFC-1035 domain string. The domain MUST be a secondary-level domain that is under control by the institution. Preferably, the institution's main domain name should be used.

Description

The user's organization using the organization's domain name; syntax in accordance with RFC 1035.

Examples

uniharderwijk.nl
example.nl 

Notes

  •  In the past, SURFconext used to send the home organization in the attribute urn:oid:1.3.6.1.4.1.1466.115.121.1.15, which was incorrect.  Since 2013, the correct oid urn:oid:1.3.6.1.4.1.25178.1.2.9 is in use.  For reasons of compatibility, the old (wrong) key is still sent.  It should not will be used removed in new implementations2020.
  • Matching values against this attribute should be case-insensitive, i.e. the values "uniharderwijk.nl" and "UniHarderwijk.nl" should be considered equal. For Interoperability reasons however we require lower-case values as specified above in SURFconext.
  • It is desirable to have the same value for all your users.
  • SURFconext will store the allowed value for your institution in our configuration so we can check that no illegal values are being sent.

...

urn:maceurn:mace:dir:attribute-def:eduPersonScopedAffiliation
urn:oidurn:oid:1.3.6.1.4.1.14665923.1151.1211.1.159
Multiplicitymulti-valued
Data typeUTF8 String of the form affiliation@domain (see below)
Description

Indicates the relationship between the user and the domain of his home organization. The affiliation part must be one of the allowed values of the eduPersonAffiliation attribute (see definition right above).

The value is the role of the user and the domain name of the organisation. eduPersonScopedAffiliation can hence be defined as: <eduPersonAffiliation> "@" <schacHomeOrganization>. Just like eduPersonScopedAffiliation, this is a multi valued attribute.

The domain part must be the schacHomeOrganization of the user (or a subdomain thereof). 

Examplesstudent@uniharderwijk.nl
faculty@uniharderwijk.nl
Notes
  • This attribute is primarily a different way to convey the same information as is contained in eduPersonAffiliation and schacHomeOrganization. It's recommended to release this attribute next to eduPersonAffiliation and schacHomeOrganization, because some SP's ask for this attribute instead of the two separate ones.
  • If desired, this attribute can be used to describe the role of the user within a specific faculty, field, study or department that the user is part of. Because the attribute is multi-valued, a user can be a student at one and an employee at another department.

...

urn:mace

urn:mace:dir:attribute-def:eduPersonEntitlement

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.1.1.7

Multiplicity

multi-value

Data typeRFC-2141 URN

Description

entitlement; custom URI (URL or URN) that indicates an entitlement to something.

Examples

urn:mace:terena.org:tcs:personal-admin
urn:x-surfnet:surfdomeinen.nl:role:dnsadmin

Notes

  • This attribute can be used to communicate entitlements, roles, etc, from identity providers to services, which can be used, for example, for authorization.
  • The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
  • Formatting rules apply: See also the SURFconext entitlement name-spacing policy.

...

.7

Multiplicity

multi-value

Data typeRFC-2141 URN

Description

entitlement; custom URI (URL or URN) that indicates an entitlement to something.

Examples

urn:mace:terena.org:tcs:personal-admin
urn:x-surfnet:surfdomeinen.nl:role:dnsadmin

Notes

  • This attribute can be used to communicate entitlements, roles, etc, from identity providers to services, which can be used, for example, for authorization.
  • The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
  • Formatting rules apply: See also the SURFconext entitlement name-spacing policy.

Anchor
eduPersonPrincipalName
eduPersonPrincipalName
Principal name

urn:mace

urn:mace:dir:attribute-def:eduPersonPrincipalName

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.6

Multiplicity

single-valued

Data typeUTF8 String of the form user@scope

Description

Unique identifier for a user.  

Examplespiet.jønsen@example.e
not.a@vålîd.émail.addreß

Notes

  • This is a scoped identifier for a person. It should be represented as user@scope, where user is a name-based identifier for a person. The scope part of the attribute must be part of an administrative domain of the identity system where the identifier was created and assigned. An IdP can have multiple scopes, e.g. piet@student.hartingcollege.nl or piet@hartingcollege.nl. These Piet's are different persons and are scoped under the administrative domain of e.g. hartingcollege.nl were the scope was defined.
  • It is common that schacHomeOrganization is used for the scope, if no other scopes are defined.
  • Although this value resembles an email address, it MUST NOT be used as an email address. In many cases mail cannot be delivered to this "address".
  • Even though this value uniquely identifies a user, it is not guaranteed that it is persistent over sessions (even though it usually is).
  • It is preferred to not use this to uniquely identify users.  Use the NameId instead.
  • SURFconext will store the allowed domain part for your institution in our configuration so we can check that no illegal values are being sent.

Anchor
isMemberOf
isMemberOf
isMemberOf

urn:mace

urn:mace:dir:attribute-def:isMemberOf

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.5.1.1

Multiplicity

multi-valued

Data typeRFC-2141 URN 

Description

Lists the collaborative organizations the user is a member of.

Examplesurn:collab:org:surf.nl

Notes

  • Attribute values are URIs (URN or URL)
  • The only currently supported value is urn:collab:org:surf.nl, which indicated that the user's home institution is a member of SURFnet
  • In the future, this can be used to determine membership of non-institutional collaborative organizations.
  • This attribute is generated by SURFconext and is available to SP's; it should not be set by IdP's.

Anchor
preferredLanguage
preferredLanguage
Preferred Language

urn:mace

urn:mace:dir:attribute-def:preferredLanguage

urn:oid

urn:oid:2.16.840.1.113730.3.1.39

Multiplicity

single-valued

Data typeRFC2798 BCP47

Description

a two-letter abbreviation for the preferred language according to the ISO 639 language abbreviation code table; no subcodes.

Examples

nl
en

Notes

Used to indicate an individual's preferred written or spoken language. This is useful for international correspondence or human-computer interaction. Values for this attribute type MUST conform to the definition of the Accept-Language header field defined in RFC 2068 with the exception that the value ":" should be omitted. 

Anchor
eduPersonTargetedID
eduPersonTargetedID
EduPersonTargetedID

urn:mace

urn:mace:dir:attribute-def:eduPersonTargetedID

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.10

Multiplicity

single-valued

Data typeUTF8 string (unbounded)

Description 

The attribute eduPersonTargetedID is a copy of the persistent Subject -> NameID, which is generated by SURFconext itself. When an Identity Provider provides the eduPersonTargetedID itself, it is always overwritten by SURFconext. 

Examplesbd09168cf0c2e675b2def0ade6f50b7d4bb4aae

Notes 

This attribute is created because the Subject -> NameID itself is not part of the SAML v2.0 response and therefore only is available for an application if the local SAML implementation explicitly supports this. Within SURFconext the Subject -> NameID is explicitly copied into the eduPersonTargetedID attribute, in order for the identifier to be used like any other attribute, but only when NameID is configured to be persistent (as the eduPerson definition of eduPersonTargetedID requires it to be persistent)


Anchor
eduPersonORCID
eduPersonORCID
eduPersonORCID

urn:mace

urn:mace:dir:attribute-def:eduPersonOrcid

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.16

Multiplicity

multi-valued (see remark below)

Data type

URL, registered with ORCID.org

Description 

The ORCID is a persistent digital identifier that distinguishes the account holder from every other researcher. Through integration in research workflows such as manuscript and grant submission, the ORCID identifier supports automated linkages between the account holder and his/her professional activities ensuring that the account holder's work is recognized. Values MUST be valid ORCID identifiers in the ORCID preferred URL representation, i.e. http://orcid.org/0000-0002-1825-0097

Examples

http://orcid.org/0000-0002-1825-0097

http://orcid.org/0000-0001-9351-8252

Notes 

Although the attribute is in theory multi-valued, in practice it probably makes sense that it has no more than one value.

Anchor
eduPersonAssurance
eduPersonAssurance
eduPersonAssurance

urn:mace

urn:mace:dir:attribute-def

:eduPersonPrincipalName

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.6

Multiplicity

single-valued

Data typeUTF8 String of the form user@scope

Description

Unique identifier for a user.  

Examplespiet.jønsen@example.e
not.a@vålîd.émail.addreß

Notes

  • This is a scoped identifier for a person. It should be represented as user@scope, where user is a name-based identifier for a person. The scope part of the attribute must be part of an administrative domain of the identity system where the identifier was created and assigned. An IdP can have multiple scopes, e.g. piet@studenthartingcollege.nl or piet@hartingcollege.nl. These Piet's are different persons and are scoped under the administrative domain of e.g. hartingcollege.nl were the scope was defined.
  • It is common that schacHomeOrganization is used for the scope, if no other scopes are defined.
  • Although this value resembles an email address, it MUST NOT be used as an email address. In many cases mail cannot be delivered to this "address".
  • Even though this value uniquely identifies a user, it is not guaranteed that it is persistent over sessions (even though it usually is).
  • It is preferred to not use this to uniquely identify users.  Use the NameId instead.
  • SURFconext will store the allowed domain part for your institution in our configuration so we can check that no illegal values are being sent.

...

:eduPersonAssurance

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.16

Multiplicity

multi-valued

Data type

URL

Description 

Set of URIs that assert compliance with specific standards for identity assurance.

Examples
https://refeds.org/assurance/ID/unique
https://refeds.org/assurance/IAP/medium

Notes 

Assertion by the home institution about specific aspects of identity proofing or authentication strength. Although in principe any URI is allowed, SURFconext recommends to populate this according to the standards as outlined in REFEDS Assurance Framework. The institution needs to match their identity management practices to this standard to know what values it may assert. This provides ways to communicate properties about e.g. identity proofing or identifier lifetimes, for interpretation by SPs. SURFconext itself does not do anything specific with released values.

Anchor
eckid
eckid
ECK ID

...

urn:mace

urn:mace:

dir

surf.nl:attribute-def:

isMemberOf

eckid

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.5.1.1

-

Multiplicity

multi

single-valued

Data type
RFC-2141 URN 

Description

Lists the collaborative organizations the user is a member of.

Examplesurn:collab:org:surf.nl

Notes

  • Attribute values are URIs (URN or URL)
  • The only currently supported value is urn:collab:org:surf.nl, which indicated that the user's home institution is a member of SURFnet
  • In the future, this can be used to determine membership of non-institutional collaborative organizations.
  • This attribute is generated by SURFconext and is available to SP's; it should not be set by IdP's.

...

URL as specified by Edu-K, all-lowercase

Description 

Educatieve Content Keten Identifier (ECK ID) is a pseudonymous identifier for access to content for primary, secondary and vocational education.

Examples
  • https://ketenid.nl/spv1/eacf3765ad342feb5f65c2bf8194b4ccc3d68cec3c01d3c260636747a2b06d092fcc3a8d655bbdc4ae7d815ed005cf3a11f e9cab2365f95da3e9965501f7c98e
  • https://ketenid.nl/201703/1a5c9c7203901866532c2d72ce056e1d29cacc70836fe2bc3a517f3f9a53eed3d77ef370ad6dcf80b3f34ced1c547c7d2e679e8e47002355f938213b3656b206

Notes 

This attribute may only be used for “the access to and use of digital learning resources or the digital administration of tests and exams”.

For more information see https://www.eck-id.nl (Dutch). Also, if you query this claim information from an external data stores, such as an Enterprise Active Directory, Lightweight Directory Access Protocol (LDAP) directories or a Microsoft SQL Server, you can also define custom attribute stores to query the ECK ID claim from external data stores. Read this Microsoft blog to get to know more.

Anchor
surfcrmid
surfcrmid
SURF CRM ID

urn:mace

urn:mace:

dir

surf.nl:attribute-def:

preferredLanguage

surf-crm-id

urn:oid

urn:oid:

2.16.840

1.3.6.1.4.1.1076.

113730

20.100.

3

10.

1

50.

39

2

Multiplicity

single-valued

Data type
RFC2798 BCP47

Microsoft GUID

Description

a two-letter abbreviation for the preferred language according to the ISO 639 language abbreviation code table; no subcodes.

Examples

nl
en

Notes

Used to indicate an individual's preferred written or spoken language. This is useful for international correspondence or human-computer interaction. Values for this attribute type MUST conform to the definition of the Accept-Language header field defined in RFC 2068 with the exception that the value ":" should be omitted. 

...

urn:mace

...

urn:mace:dir:attribute-def:eduPersonTargetedID

...

urn:oid

...

urn:oid:1.3.6.1.4.1.5923.1.1.1.10

...

Multiplicity

...

single-valued

...

Description 

...

The attribute eduPersonTargetedID is a copy of the persistent Subject -> NameID, which is generated by SURFconext itself. When an Identity Provider provides the eduPersonTargetedID itself, it is always overwritten by SURFconext. 

...

Notes 

...

This attribute is created because the Subject -> NameID itself is not part of the SAML v2.0 response and therefore only is available for an application if the local SAML implementation explicitly supports this. Within SURFconext the Subject -> NameID is explicitly copied into the eduPersonTargetedID attribute, in order for the identifier to be used like any other attribute, but only when NameID is configured to be persistent (as the eduPerson definition of eduPersonTargetedID requires it to be persistent)

Description 

GUID of the organization to which the IdP belongs, as used in the SURF CRM.

Examples

ad93daef-0911-e511-80d0-005056956c1a

Notes

SURF specific and only to be used by SURF SPs that have to interface with the SURF CRM.

Only to be used after consultation with SURFnet.

Anchor
authnmethodsreferences
authnmethodsreferences
MS AuthnMethodsReferences

Name

http://schemas.microsoft.com/claims/authnmethodsreferences

Multiplicity

multi-valued

Data type

URI

Description

The AuthnContext-referenties involved in authenticating the current user on their home IdP.

Examples

urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
http://schemas.microsoft.com/claims/multipleauthn

Opmerkingen 

  • Exclusively for use between IdPs and SURFconext; not available to SPs.
  • Used when the institution has a Microsoft ADFS IdP, to communicate the used MFA method to SURFconext. Not needed or useful when this functionality is not used by the institution in question.
  • No other uses. For comparable but more generic SAML 2.0-functionality, see the AuthnContextClassRef sent in each assertion.

Anchor
OU
OU
OrganizationalUnitName

...

urn:mace

urn:mace:dir:attribute-def:

eduPersonOrcid

ou

urn:oid

urn:oid:

1

2.

3

5.

6.1.

4.

1.5923.1.1.1.16

11

Multiplicity

multi-valued

(see remark below)

Data type

URL, registered with ORCID.org

Description 

The ORCID is a persistent digital identifier that distinguishes the account holder from every other researcher. Through integration in research workflows such as manuscript and grant submission, the ORCID identifier supports automated linkages between the account holder and his/her professional activities ensuring that the account holder's work is recognized. Values MUST be valid ORCID identifiers in the ORCID preferred URL representation, i.e. http://orcid.org/0000-0002-1825-0097

Examples

http://orcid.org/0000-0002-1825-0097

http://orcid.org/0000-0001-9351-8252

Notes 

For more information see https://www.surf.nl/en/news/2016/02/global-author-identifier-service-orcid-now-available-through-surfconext-and-edugain.html

Although the attribute is in theory multi-valued, in practice it probably makes sense that it has no more than one value
UTF-8 string

Description

Indicates the department, team, or faculty with which the user is associated within the issuing institution. This attribute is multi-valued, so multiple departments, teams or faculties can be listed
Examples
  • ICT Services
  • Industrial Engineering & Innovation Sciences
  • Facility Management Center

Notes

  • The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
  • Content is by definition institution-specific. It has no other meaning other than agreed upon between SP and IdP.


Anchor
eduID
eduID
eduID

urn:mace

urn:mace:eduid.nl:1.1

Multiplicity

single-valued

Data typeUTF-8 string

Beschrijving

Targeted unique eduID-identifier for a user
Voorbeelden

658b6b41-7c13-431d-b3b4-663e9077c24c
f4c9afe4-b9e1-42bb-92b8-047ac8711e29

Opmerkingen

  • This is a targeted identifier for a person.
  • It will preferbly be formatted as a version 4 UUID.
  • An eduID-identifier exists independent of an educational institution.
  • The eduID-identifier is meant for services where an institution-independent account is useful, or when data on a user needs to be exchanged between institutions.