Page History

urn:mace

urn:mace:dir:attribute-def:sn

urn:oid

urn:oid:2.5.4.4

Multiplicity

single-valued

Description

The surname of a person (including any words such as “van”, “de”, “von” etc.) used for personalisation; this can be a combination of existing attributes.

Notes

urn:mace

urn:mace:dir:attribute-def:displayName

urn:oid

urn:oid:2.16.840.1.113730.3.1.241

Multiplicity

single-valued

Description

Name as displayed in applications

Notes

•  This attribute can typically be changed by the end-users themselves, and is therefore not very suitable for identification.

urn:mace

urn:mace:dir:attribute-def:mail

urn:oid

urn:oid:0.9.2342.19200300.100.1.3

Multiplicity

multi-valued

Description

e-mail address; syntax in accordance with RFC 5322accordance with RFC 5322

Notes

• Multiple email addresses are allowed
• An email address is not necessarily the email address of this person at the institution.
• Do not use this attribute to uniquely identify a user.  Use the NameId  instead.
• A user's email address may change over time, or an IdP may allow a user to change this value themselves. This makes that attribute unsuitable for authentication and authorization purposes.

urn:mace

urn:mace:dir:attribute-def:uid

urn:oid

urn:oid:0.9.2342.19200300.100.1.1

Multiplicity

multi-valued

Description

The unique code for a person that is used as the login name within the institution.

Notes

• The uid is not a unique identifier for SURFconext users.  Uid values are at most unique for each IdP.
• Ideally the uid is not only a login name/code but also an identifier that is guaranteed as being unique within the institution over the course of time. At the moment, there is no such guarantee.
• Use the NameId for unique identifiers in SURFconext rather than uid.
• Use the eduPersonPrincipalName attribute if a human-readable unique identifier is required
• A uid may contain any unicode character. E.g., "org:surfnet.nl:joe von stühl" is a valid uid.
• SURFconext translates @-characters in the uid to underscores.  Yes, this means that uids are not guaranteed to be unique.

urn:mace

urn:mace:terena.org:attribute-def:schacHomeOrganization

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.9

Multiplicity

single-valued

Description

The user's organisation using the organisation’s domain name; syntax in accordance with RFC 1035.

Notes

•  In the past, SURFconext used to send the home organisation in the attribute urn:oid:1.3.6.1.4.1.1466.115.121.1.15, which was incorrect.  Since 2013, the correct oid urn:oid:1.3.6.1.4.1.25178.1.2.9 is in use.  For reasons of compatibility, the old (wrong) key is also still sent.  It should not be used in new implementations.
• Matching values against this attribute should be case-insensitive, i.e. the values "uniharderwijk.nl" and "UniHarderwijk.nl" should be considered equal.

urn:mace

urn:mace:terena.org:attribute-def:schacHomeOrganizationType

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.10

Multiplicity

single-value

Description

designation of the type of organisation as defined on http://www.terena.org/registry/terena.org/schac/homeOrganizationType

Notes

• Attribute values are registered by Terena on http://www.terena.org/registry/terena.org/schac/homeOrganizationType
• In practice, this attribute is not in use.

urn:mace

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.14

Multiplicity

multi-value-value

Description

The user's student, employee, and/or member id as used in the university's internal systems

Notes

• Attribute values are registered by SURFnet on https://wiki.surfnet.nl/x/xoTdAg
• Please contact the SURFnet support team if you would like to use this attribute as an SP, or if you would like to provide it as an IdP.
• This attribute's main use is for matching user accounts to the university's internal systems

urn:mace

urn:mace:dir:attribute-def:eduPersonAffiliation

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.1

Multiplicity

multi-valued

Description

Indicates the relationship between the user and his home organisation.  The following values are permitted:

• student — student
• employee — all employees
• staff — academic staff
• member — anyone employed by or studying at the institution

Notes

• Any user who has the affiliation student, employee, or staff, should also have the value member.
• Identity providers might internally use additional values for the affiliation attribute, such as alum or affiliate.  Per SURFconext policy, such users are not allowed access to SURFconext.
• According to the eduPerson specification, the values of this attribute are case insensitive; for interoperability reasons however, we require lower-case values as specified above in SURFconext.

urn:mace

urn:mace:dir:attribute-def:eduPersonEntitlement

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.7

Multiplicity

multi-value

Description

entitlement; custom URI (URL or URN) that indicates an entitlement to something.

Notes

• This attribute can be used to communicate entitlements, roles, etc, from identity providers to services, which can be used, for example, for authorization.
• The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
• Formatting rules apply: See also the SURFconext entitlement namespacing policy.

urn:mace

urn:mace:dir:attribute-def:eduPersonPrincipalName

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.6

Multiplicity

single-valued

Description

Unique identifier for a user.  

Notes

• Although this value resembles an email address, it MUST NOT be used as an email address. In many cases mail cannot be delivered to this "address".
• Even though this value uniquely identifies a user, it is not guaranteed that it is persistent over sessions (even though it usually is).
• Do not use this to uniquely identify users.  Use the NameId instead.

urn:mace

urn:mace:dir:attribute-def:isMemberOf

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.5.1.1

Multiplicity

multi-valued

Description

Lists the collaborative organisations the user is a member of.

Notes

• Attribute values are URIs (URN or URL)
• Only current supported value is urn:collab:org:surf.nl, which indicated that the user's home institution is a member of SURFnet
• In the future, this can be used to determine membership of non-institutional collaborative organisations.

urn:mace

urn:mace:dir:attribute-def:preferredLanguage

urn:oid

urn:oid:2.16.840.1.113730.3.1.39

Multiplicity

single-valued

Description

a two-letter abbreviation for the preferred language according to the ISO 639 language abbreviation code table; no subcodes.

Notes

Used to indicate an individual's preferred written or spoken language. This is useful for international correspondence or human-computer interaction. Values for this attribute type MUST conform to the definition of the Accept-Language header field defined in RFC 2068 with one exception: ?the value ":" should be omitted. 

urn:mace

urn:mace:dir:attribute-def:eduPersonTargetedID

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.10

Multiplicity

single-valued

Description 

The attribute eduPersonTargetedID is a copy of the Subject -> NameID which is generated by SURFconext itself. When an Identity Provider provides the eduPersonTargetedID itself, it is always overwritten by SURFconext.

Notes 

This attribute is created because the Subject -> NameID itself is not part of the SAML v2.0 response and therefore can not be used. Within SURFconext the Subject -> NameID is explicitly placed in the attribute eduPersonTargetedID, so that you can use it.