Page History

ID

SAML NameID element
urn:mace:dir:attribute-def:eduPersonTargetedID
urn:oid:1.3.6.1.4.1.5923.1.1.1.10

bd09168cf0c2e675b2def0ade6f50b7d4bb4aae

Surname

urn:mace:dir:attribute-def:sn
urn:oid:2.5.4.4

Doe

Vermeegen
孝慈

Given name or first name

urn:mace:dir:attribute-def:givenName
urn:oid:2.5.4.42

John

Mërgim Lukáš

Þrúður

Common name or Full Name

urn:mace:dir:attribute-def:cn
urn:oid:2.5.4.3

John Doe

Prof.dr. Mërgim Lukáš Vermeegen

加来 千代, PhD.

Display name

urn:mace:dir:attribute-def:displayName
urn:oid:2.16.840.1.113730.3.1.241

Dr. John Doe

Prof.dr. Mërgim L. Vermeegen

加来 千代, PhD.

Email address

urn:mace:dir:attribute-def:mail
urn:oid:0.9.2342.19200300.100.1.3

m.l.vermeegen@university.example.org

maarten.'t.hart@uniharderwijk.nl 

"very.unusual.@.but valid.nonetheless"@example.com

mlv@[IPv6:2001:db8::1234:4321]

Organization

urn:mace:terena.org:attribute-def:schacHomeOrganization
urn:oid:1.3.6.1.4.1.25178.1.2.9

example.nl

something.example.org  

Organization Type

urn:mace:terena.org:attribute-def:schacHomeOrganizationType
urn:oid:1.3.6.1.4.1.25178.1.2.10

urn:mace:terena.org:schac:homeOrganizationType:int:university

urn:mace:terena.org:schac:homeOrganizationType:es:opi

urn:schac:attribute-def:schacPersonalUniqueCode
urn:oid:1.3.6.1.4.1.25178.1.2.14

urn:schac:personalUniqueCode:nl:local:example.edu:employeeid:x12-3456

urn:schac:personalUniqueCode:nl:local:example.nl:studentid:s1234567

Affiliation

urn:mace:dir:attribute-def:eduPersonAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.1

employee, student, faculty, member, affiliate, pre-student

student@uniharderwijk.nl

employee@uniharderwijk.nl

Entitlement

urn:mace:dir:attribute-def:eduPersonEntitlement
urn:oid:1.3.6.1.4.1.5923.1.1.1.7

to be determined per service (see Standardized values for eduPersonEntitlement)

PrincipalName

urn:mace:dir:attribute-def:eduPersonPrincipalName
urn:oid:1.3.6.1.4.1.5923.1.1.1.6

piet.jønsen@example.edu

not.a@vålîd.émail.addreß

isMemberOf

urn:mace:dir:attribute-def:isMemberOf
urn:oid:1.3.6.1.4.1.5923.1.5.1.1

urn:collab:org:surf.nl

urn:collab:org:clarin.org

uid

urn:mace:dir:attribute-def:uid
urn:oid:0.9.2342.19200300.100.1.1

s9603145

flåp@example.edu

preferredLanguage

urn:mace:dir:attribute-def:preferredLanguage
urn:oid:2.16.840.1.113730.3.1.39

nl

nl, en-gb;q=0.8, en;q=0.7

urn:mace:dir:attribute-def:eduPersonORCID

urn:oid:1.3.6.1.4.1.5923.1.1.1.16

urn:mace:dir:attribute-def:eduPersonAssurance

urn:oid:1.3.6.1.4.1.5923.1.1.1.11

https://refeds.org/assurance/ID/unique

urn:mace:surf.nl:attribute-def:eckid

OrganizationalUnitName

ICT Services
Geesteswetenschappen
Facilitair

urn:mace

urn:mace:dir:attribute-def:sn

urn:oid

urn:oid:2.5.4.4

Multiplicity

single-valued

Description

The surname of a person (including any words such as “van”, “de”, “von” etc.) used for Personalizationpersonalization; this can be a combination of existing attributes.

Vermeegen 

Valk, van der
孝慈

Notes

urn:mace

urn:mace:dir:attribute-def:givenName

urn:oid

urn:oid:2.5.4.42

Multiplicity

single-valued

Description

Given name, also known as a first name, forename or Christian name / “name known by”; combinations of title, initials, and “name known by” are possible.

Jan Klaassen
Mërgim K. Lukáš 
Þrúður

Notes

Words such as “van”, “de”, “von” must not be in this attribute, but in Surname.

urn:mace

urn:mace:dir:attribute-def:uid

urn:oid

urn:oid:0.9.2342.19200300.100.1.1

Multiplicity

Description

The unique code for a person that is used as the login name within the institution.

s9603145 
piet 
flåp@example.edu (See note below)

Notes

• The uid is not a unique identifier for SURFconext users.  Uid values are at most unique for each IdP.
• Ideally the uid is not only a login name/code but also an identifier that is guaranteed as being unique within the institution over the course of time. At the moment, there is no such guarantee.
• Use the NameId for unique identifiers in SURFconext rather than uid.
• Use the eduPersonPrincipalName attribute if a human-readable unique identifier is required
• A uid may contain any unicode character. E.g., "org:surfnetsurf.nl:joe von stühl" is a valid uid.
• SURFconext translates @-characters in the uid to underscores before constructing the NameID. flåp@example.edu translates to flåp_example.edu.

urn:mace

urn:mace:terena.org:attribute-def:schacHomeOrganization

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.9

Multiplicity

single-valued

Description

The user's organization using the organization's domain name; syntax in accordance with RFC 1035.

uniharderwijk.nl
example.nl 

Notes

•  In the past, SURFconext used to send the home organization in the attribute urn:oid:1.3.6.1.4.1.1466.115.121.1.15, which was incorrect.  Since 2013, the correct oid urn:oid:1.3.6.1.4.1.25178.1.2.9 is in use.  For reasons of compatibility, the old (wrong) key is still sent.  It will be removed in 2020the near future.
• Matching values against this attribute should be case-insensitive, i.e. the values "uniharderwijk.nl" and "UniHarderwijk.nl" should be considered equal. For Interoperability reasons however we require lower-case values as specified above in SURFconext.
• It is desirable to have the same value for all your users.
• SURFconext will store the allowed value for your institution in our configuration so we can check that no illegal values are being sent.

urn:mace

urn:mace:terena.org:attribute-def:schacHomeOrganizationType

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.10

Multiplicity

single-value

Description

designation of the type of organization as defined on httphttps://wwwwiki.terenarefeds.org/registry/terena.org/schac/homeOrganizationType/display/STAN/SCHAC+Releases?preview=/44957731/128909315/SCHAC%2B1.6.0-final.pdf

Notes

• Attribute values are registered by Terena Géant on httphttps://wwwwiki.terenarefeds.org/registrydisplay/terena.org/schac/homeOrganizationTypeSTAN/SCHAC+Releases
• In practice, this attribute is not/hardly used by IdP's or SP's
• Please contact support@surfconext.nl if you would like to use this attribute

urn:mace

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.14

Multiplicity

multi-value

Description

The user's student, employee, and/or member id as used in the university's internal systems. Also used for the Erasmus Student Identifier for international student exchange.

urn:schac:personalUniqueCode:nl:local:example.edu:employeeid:x12-3456
urn:schac:personalUniqueCode:nl:local:example.nl:studentid:s1234567
urn:schac:personalUniqueCode:int:esi:example.nl:123321

Notes

• Attribute values are registered by SURFnet SURF as shown on this page.
• Please contact the SURFnet SURFconext support team if you would like to use this attribute as an SP, or if you would like to provide it as an IdP.
• This attribute's main use is for matching user accounts to the university's internal systemsto the university's internal systems
• It is also used in the Erasmus+ student exchange program. See Toevoegen European Student Identifier aan instellingssystemen.

urn:mace

urn:mace:dir:attribute-def:eduPersonAffiliation

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.1

Multiplicity

multi-valued

Description

Indicates the relationship between the user and his home organization (institution). The following values are permitted within SURFconext:

• student — A person enrolled at an institution, an external student or course participant.
• employee — A person with a position at or labor agreement with an institution.
• staff — All academic staff and teachers. (deprecated; do not use in new deployments)
• faculty — A person whose primary role is teaching or research. (Commonly called WP at Dutch universities. Please note, PhD students are also perfectly allowed to carry this value.)
• member — Anyone that holds at least one of the above affiliations is also a member.
  
  
• pre-student — A person who has registered to start studying, but is not yet a full student. See this page (Dutch only) for more information about pre-students and the terms and conditions under which such users are allowed access. Pre-students will never be allowed access to service providers without prior consent from the service provider.
• affiliate — A person who is authorized by the Institution, pursuant to the lenience model concluded by the Institution, to use the Service.

Use Note: only the above mentioned values are allowed within SURFconext. Use the definitions mentioned to determine which affiliation a user gets. If the definitions are not sufficientyou have doubts whether a user (fully) fits the definition, please use common sense.

Notes

• Any user who has the affiliation student, employee, or faculty, should also have the value member.
• Identity Providers might internally use additional values for the affiliation attribute, such as alum. Per SURFconext policy, the IdP may not allow such users to access SURFconext.
  Other values mentioned in the eduPerson specification include library-walk-in. This value is not currently used within SURFconext.
• According to the eduPerson specification, the values of this attribute are case insensitive; for Interoperability reasons however, we require lower-case values as specified above in SURFconext.
• The document REFEDS eduPerson(Scoped)Affiliation usage comparison is useful to determine the usefulness of values in an international context.

urn:mace

urn:mace:dir:attribute-def:eduPersonEntitlement

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.7

Multiplicity

multi-value

Description

entitlement; custom URI (URL or URN) that indicates an entitlement to something.

urn:mace:terena.org:tcs:personal-admin
urn:x-surfnetmace:surf.nl:surfdomeinen.nl:role:dnsadmin

Notes

• This attribute can be used to communicate entitlements, roles, etc, from identity providers to services, which can be used, for example, for authorization.
• The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
• Formatting rules apply: See also the SURFconext entitlement name-spacing policy.

urn:mace

urn:mace:dir:attribute-def:isMemberOf

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.5.1.1

Multiplicity

multi-valued

Description

Lists the collaborative organizations the user is a member of.

Notes

• Attribute values are URIs (URN or URL)
• The only currently supported value is urn:collab:org:surf.nl, which indicated that the user's home institution is a member of SURFnetSURF
• In the future, this can be used to determine membership of non-institutional collaborative organizations.
• This attribute is generated by SURFconext and is available to SP's; it should not be set by IdP's.

urn:mace

urn:mace:dir:attribute-def:eduPersonTargetedID

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.10

Multiplicity

single-valued

Description 

The attribute eduPersonTargetedID is a copy of the persistent Subject -> NameID, which is generated by SURFconext itself. When an Identity Provider provides the eduPersonTargetedID itself, it is always overwritten by SURFconext. 

always overwritten by SURFconext. 

Notes 

This attribute is created because the Subject -> NameID itself is not part of the SAML v2.0 response attribute list and therefore only is available for an application if the local SAML implementation explicitly supports this. Within SURFconext the Subject -> NameID is explicitly copied into the eduPersonTargetedID attribute, including XML, in order for the identifier to be used like any other attribute, but only when NameID is configured to be persistent (as the eduPerson definition of eduPersonTargetedID requires it to be persistent)