Page History

...

SURFconext supports two atttributes schemas: the urn:oid schema and the urn:mace schema. Both of these can be used to convey the same information (except for the NameId, which is only available in the urn:oid schema. By default SURFconext will provide attributes in both schemata as part of the assertion. It is not recommended to mix the use of these schemata.

Attribute overview

SURFconext supported relaying of the following attributes:

Friendly name	Attribute name	Definition	Data type	Example
ID	(NameId) urn:oid:1.3.6.1.4.1.5923.1.1.1.10	eduPerson	UTF8 string (unbounded)	bd09168cf0c2e675b2def0ade6f50b7d4bb4aae
Surname	urn:mace:dir:attribute-def:sn urn:oid:2.5.4.4	X.520	UTF8 string (unbounded)	Vermeegen ?
Given name	urn:mace:dir:attribute-def:givenName urn:oid:2.5.4.42	X.520	UTF8 string (unbounded)	Mërgim Lukáš ??
Common name	urn:mace:dir:attribute-def:cn urn:oid:2.5.4.3	X.520	UTF8 String (unbounded)	Prof.dr. Mërgim Lukáš Vermeegen ? ??, PhD.
Display name	urn:mace:dir:attribute-def:displayName urn:oid:1.3.6.1.4.1.1466.115.121.1.15	RFC2798	UTF8 String (unbounded)	Prof.dr. Mërgim L. Vermeegen ? ??, PhD.
Email address	urn:mace:dir:attribute-def:mail urn:oid:0.9.2342.19200300.100.1.3	RFC4524	RFC-5322 address (max 256 chars)	m.l.vermeegen@university.example.org "very.unusual.@.unusual.com"@example.com <ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="af6dbf92b37dcfdb-2ba162a4-480b4781-996494e1-2c5c1d608fe9fc8bcc083a51"><ac:plain-text-body><![CDATA[mlv@[IPv6:2001:db8::1234:4321]	]]></ac:plain-text-body></ac:structured-macro>
Organization	urn:mace:terena.org:attribute-def:schacHomeOrganization urn:oid:1.3.6.1.4.1.25178.1.2.9	Schac	RFC-1035 domain string	university.example.org
Organization Type	urn:mace:terena.org:attribute-def:schacHomeOrganizationType urn:oid:1.3.6.1.4.1.25178.1.2.10	Schac	RFC-2141 URN see Schac standard	urn:mace:terena.org:schac:homeOrganizationType:int:university urn:mace:terena.org:schac:homeOrganizationType:es:opi
Affiliation	urn:mace:dir:attribute-def:eduPersonAffiliation urn:oid:1.3.6.1.4.1.5923.1.1.1.1	eduPerson	Enum type (UTF8 String)	faculty, student, staff, alum, member, affiliate, employee, library-walk-in
Entitlement	urn:mace:dir:attribute-def:eduPersonEntitlement urn:oid:1.3.6.1.4.1.5923.1.1.1.7	eduPerson	RFC-2141 URN Multi-valued	to be determined
PrincipalName	urn:mace:dir:attribute-def:eduPersonPrincipalName urn:oid:1.3.6.1.4.1.5923.1.1.1.6	eduPerson	UTF8 String user@domain	not.a@vålîd.émail.addreß ??@aninstitutionname
isMemberOf	urn:mace:dir:attribute-def:isMemberOf urn:oid:1.3.6.1.4.1.5923.1.5.1.1	eduMember	RFC-2141 URN Multi-valued	urn:collab:org:surf.nl urn:collab:org:clarin.org
uid	urn:mace:dir:attribute-def:uid urn:oid:1.3.6.1.4.1.1466.115.121.1.15	RFC4519	UTF8 String (max 256 chars)	s9603145 flåp_example.edu
preferredLanguage	urn:mace:dir:attribute-def:preferredLanguage urn:oid:2.16.840.1.113730.3.1.39	RFC2798	BCP47 language tag	nl-BE en-US

Note that not all identity providers might make all attributes available.

More information

http://www.incommon.org/federation/attributesummary.html
saml2int.org

Attributes

The following attributes can be included in the response from SURFconext to the service provider. They contain information about the authenticated user. This will make it possible for the service to for instance show the "displayName" of the user in the interface or determine the affiliation of the user for authorization. For instance a student has a different view than a teacher.

Detailed attribute descriptions

uid

urn:mace	urn:mace:dir:attribute-def:uid
urn:oid	urn:oid:1.3.6.1.4.1.1466.115.121.1.15
Multiplicity	single-value
Description	The unique code for a person that is used as the login name within the institution.
Notes	Ideally the uid is not only a login name/code but also an identifier that is guaranteed as being unique within the institution over the course of time. At the moment, there is no such guarantee. Use the NameId for unique identifiers in SURFconext rather than uid. Use the eduPersonPrincipalName attribute if a human-readable unique identifier is required A uid may contain any unicode character. E.g., "`org:surfnet.nl:joe von stühl`" is a valid uid. SURFconext translates @-characters in the uid to underscores. Yes, this means that uids are not guaranteed to be unique.

Surname

Attribute	Attribute (OID)	Example	Remarks
urn:mace
`urn:mace:dir:attribute-def:displayName`	`urn:oid:2.16.840.1.113730.3.1.241`	John Doe	Usually this is equal to `cn`.	urn:mace:dir:attribute-def:mailsn
urn:oid	urn:oid:0.9.2342.19200300.100.1.3	john@example.org	This attribute can contain multiple email addresses.	`urn:mace:dir:attribute-def:sn`	urn:oid:2.5.4.4
Multiplicity Doe
`urn:mace:dir:attribute-def:cn`	`urn:oid:2.5.4.3`	John Doe
single-value
Description	The surname of a person (including any words such as "van", "de", "von" etc.) used for personalisation; this can be a combination of existing attributes.
Notes

Given name

urn:mace	urn:mace:dir:attribute-def:givenName
urn:oid	urn:oid:2.5.4.42	John
Multiplicity	single-value
Description	Given name / "name known by"; combinations of title, initials, and "name known by" are possible.
Notes

Common name

urn:mace	urn:mace:dir:attribute-def:cn
urn:eduPersonPrincipalNameoid	urn:oid:1.3.6.1.4.1.5923.1.1.1.6	john_doe@example.org	This is not necessarily a valid email address!	`urn:mace:terena.org:attribute-def:schacHomeOrganization`	`urn:oid:1.3.6.1.4.1.1466.115.121.1.15`	example.org	2.5.4.3
Multiplicity	single-value (?) Volgens de rfc is het multi-valued
Description	Full name.
Notes	For example, a typical name of a person in an English-speaking country comprises a personal title (e.g. Mr., Ms., Rd, Professor, Sir, Lord), a first name, middle name(s), last name, generation qualifier (if any, e.g. Jr.) and decorations and awards (if any, e.g. CBE).

Display name

urn:mace	urn:mace:dir:attribute-def:uiddisplayName
urn:oid	urn:oid:01.93.23426.192003001.1004.1.1466.115.121.1	john_doe	.15
Multiplicity	single-value
Description	Name as displayed in applications
Notes

Email address

urn:mace You should not use this for (unique) user identification purposes in your service!	urn:mace:dir:attribute-def:eduPersonAffiliationmail
urn:oid	urn:oid:10.39.62342.119200300.4100.1.5923.1.1.1.1	student	Supported values: `employee`, `student` and `affiliate`.
`urn:mace:dir:attribute-def:isMemberOf`	`urn:oid:1.3.6.1.4.1.5923.1.5.1.1`	urn:collab:org:surf.nl	Contact us before you want to use this attribute!

...

3
Multiplicity	multi-value
Description	e-mail address; syntax in accordance with RFC 5322
Notes	This is a multi-value attribute. An email address is not necessarily the email address of this person at the institution, it can also be a @google.com, @hotmail.com or @vanitydomain.org address. The mail may change over time for a user, also an IdP may allow a user to set this value. This makes that attribute unsuitable for authentication and authorization purposes.

...

urn:mace:dir:attribute-def:

...

eduPersonAffiliation

Note
Currently we convert `schacHomeOrganization` to the wrong OID. The correct value is `urn:oid:1.3.6.1.4.1.25178.1.2.9`. This will be fixed soonish.

Note
UID is the unique identifier of the user at the home institution, it is not unique for all users in SURFconext! Use eduPersonTargetedID (preferred) or eduPersonPrincipalName if you need to uniquely identify users.

A service provider SHOULD only at most request the following attributes, requesting these and any other attributes MUST BE accompanied by an explanation of why they are needed:

...

Multiplicity

multi-value

Description

indicates the relationship between the user and his/her own organisation; possible values:

student - student
employee - all employees
staff - academic staff
alum - alumnus
affiliate - third party; no direct work relationship with the institution (either paid or unpaid)

Notes

Note that you must not allow alum or affiliate users to access SURFfederatie. Providing this attribute is not sufficient to deny these users access to SURFfederatie as many service providers do not receive this attribute. Please contact federatie-beheer@surfnet.nl if you have questions about this.

urn:mace:dir:attribute-def:

...

eduPersonEntitlement

Multiplicity	multi-value
Description	entitlement; URI (URL or URN) that indicates an entitlement to something; is determined by a contract between the service provider and the institution.
Notes

...

urn:mace:dir:attribute-def:

...

The attributes are available in both human readable format and OID format. See also this eduGAIN recommendation.

Ultimately it is up to the identity provider and service provider to agree on a set of attributes to be released by the IdP, SURFconext only mediates. However, it is strongly recommend to stick to the above attributes as they are standardized and ensure greater interoperability.

The table below lists the attributes that have been defined for use within SURFfederatie. This list was created in consultation with the connected institutions, specifically within the 3TU partnership. With a view to the expected future international collaboration, this table is largely based on the EduPerson and SCHAC tables. A number of attributes that are specific to SURFfederatie and the Netherlands have been added.

Info
Note that the attributes described on this page are the standardised attributes that an identity provider may provide to the SURFnet federation gateway. If you are a service provider connecting to SURFconext, please refer to the attribute description on ?Authentication using SAML page.

Attributes overview

A more detailed description of each attribute can be found in the next section.

...

Attribute Name
(abbreviated)

...

Description

...

Example value(s)

...

uid

...

user id/login name

...

joebloggs

...

4236712

...

sn

...

surname

...

Bloggs

...

Smith

...

givenName

...

given name

...

Joe

...

Prof. H.A.B.

...

cn

...

full name

...

Joseph Bloggs

...

displayName

...

display name

...

Joey

...

mail

...

e-mail address

...

j.bloggs@rug.nl

...

H.A.B.Smith@tudelft.nl
smith_78@hotmail.com

...

eduPersonAffiliation

...

affiliation type

...

student

...

employee

...

eduPersonEntitlement

...

entitlement

...

?depends on service provider

...

eduPersonPrincipalName

...

unique name

...

joebloggs@rug.nl

...

preferredLanguage

...

preferred language

...

nl

...

en

...

schacHomeOrganization

...

domain name

...

tudelft.nl

...

eduPersonPrincipalName

Multiplicity	single-value
Description	Unique "net ID" beyond the scope of the particular institution, in the form "<user>@<scope>".E.g. "s012001234@student.example.com".
Notes	Although this value resembles an email address, it should not be used as such. In many cases mail cannot be delivered to this "address". This value should never be reassigned to another user. I.e. after a user leaves an institution, it should not be assigned to another (future) user.

urn:mace:dir:attribute-def:preferredLanguage

Multiplicity	single-value
Description	a two-letter abbreviation for the preferred language according to the ISO 639 language abbreviation code table; no subcodes.
Notes

Attributes defined in urn:mace:terena.org:attribute-def

International standardised attributes according to the Terena SCHAC schema have been defined within the namespace urn:mace:terena.org:schac: http://www.terena.org/activities/tf-emc2/schacreleases.html. The version of the SCHAC table used is 1.3.0 (12 December 2006).

urn:mace:terena.org:attribute-def:schacHomeOrganization

Multiplicity	single-value
Description	designation for the person's organisation using the organisation's domain name; syntax in accordance with RFC 1035.
Notes

...

schacHomeOrganizationType

...

type of organisation

urn:mace:terena.org:

...

nlEduPersonHomeOrganization
(deprecated)

...

name of institution

...

Delft University of Technology

...

Utrecht University of Applied Sciences

...

nlEduPersonStudyBranch

...

ROHO code

...

52734

...

nlEduPersonOrgUnit

...

department name

...

Faculty of Humanities

...

Library

...

nlStudielinkNummer

...

studielink number

...

xxxxxxxxxx

...

nlDigitalAuthorIdentifier

...

DAI number

...

070014345

...

attribute-def:schacHomeOrganizationType

Multiplicity	single-value
Description	designation of the type of organisation to which a person belongs, using the values registered by Terena on: http://www.terena.org/registry/terena.org/schac/homeOrganizationType
Notes

Attributes defined in urn:mace:surffederatie.nl:attribute-def

Nationally standardised attributes within SURFfederatie have been defined within the namespace urn:mace:surffederatie.nl:attribute-def. The name of all these attributes starts with the prefix "nl"

urn:mace:surffederatie.nl:attribute-def:nlEduPersonHomeOrganization

Multiplicity	single-value
Description
Notes	This attribute is deprecated. It has been replaced by the urn

Detailed attribute descriptions

The names of the attributes in the above table are the commonly used abbreviations. In the description below the attributes are listed using their full name. The SURFfederatie gateway will always provide the attributes by their full name. The attributes are defined in three different namespaces: urn:mace:dir:attribute-def, urn:mace:terena.org:schac and urn:mace:surffederatie.nl:attribute-def.

Attributes defined in urn:mace:dir:attribute-def

International standardised attributes according to the EduPerson schema have been defined within the namespace urn:mace:dir:attribute-def: http://middleware.internet2.edu/urn-mace/urn-mace-dir-attribute-def.html. The version of the EduPerson schema used is: MACE-Dir/Educause, eduPerson Object Class Specification (200806), http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html, June 2008

urn:mace:dir:attribute-def:uid

Multiplicity	single-value
Description	The unique code for a person that is used as the login name within the institution.
Notes	Ideally the uid is not only a login name/code but also an identifier that is guaranteed as being unique within the institution over the course of time. At the moment, there is no such guarantee. Use the eduPersonPrincipalName attribute if uniqueness over multiple institutions is required. A uid may contain any unicode character. E.g. "org:surfnet.nl:joe" is a valid uid. Note: SURFconext translates @-characters in the uid to underscores. Yes, this means that uids are not guaranteed to be unique. Note: non-ASCII7 uids are not well tested.

urn:mace:dir:attribute-def:sn

Multiplicity	single-value
Description	The surname of a person (including any words such as "van", "de", "von" etc.) used for personalisation; this can be a combination of existing attributes.
Notes

urn:mace:dir:attribute-def:givenName

Multiplicity	single-value
Description	Given name / "name known by"; combinations of title, initials, and "name known by" are possible.
Notes

urn:mace:dir:attribute-def:cn

...

Multiplicity

...

single-value

...

Description

...

Full given name.

...

Notes

urn:mace:dir:attribute-def:displayName

Multiplicity	single-value
Description	Display name as displayed in applications
Notes

urn:mace:dir:attribute-def:mail

Multiplicity	multi-value
Description	e-mail address; syntax in accordance with RFC 1274 and RFC 822.
Notes	This is a multi-value attribute. An email address is not necessarily the email address of this person at the institution, it can also be a @google.com, @hotmail.com or @vanitydomain.org address. The mail may change over time for a user, also an IdP may allow a user to set this value. This makes that attribute unsuitable for authentication and authorization purposes.

urn:mace:dir:attribute-def:eduPersonAffiliation

Multiplicity

multi-value

Description

indicates the relationship between the user and his/her own organisation; possible values:

student - student
employee - all employees
staff - academic staff
alum - alumnus
affiliate - third party; no direct work relationship with the institution (either paid or unpaid)

Notes

Note that you must not allow alum or affiliate users to access SURFfederatie. Providing this attribute is not sufficient to deny these users access to SURFfederatie as many service providers do not receive this attribute. Please contact federatie-beheer@surfnet.nl if you have questions about this.

urn:mace:dir:attribute-def:eduPersonEntitlement

Multiplicity	multi-value
Description	entitlement; URI (URL or URN) that indicates an entitlement to something; is determined by a contract between the service provider and the institution.
Notes

urn:mace:dir:attribute-def:eduPersonPrincipalName

Multiplicity	single-value
Description	Unique "net ID" beyond the scope of the particular institution, in the form "<user>@<scope>".E.g. "s012001234@student.example.com".
Notes	Although this value resembles an email address, it should not be used as such. In many cases mail cannot be delivered to this "address". This value should never be reassigned to another user. I.e. after a user leaves an institution, it should not be assigned to another (future) user.

urn:mace:dir:attribute-def:preferredLanguage

Multiplicity	single-value
Description	a two-letter abbreviation for the preferred language according to the ISO 639 language abbreviation code table; no subcodes.
Notes

...

:mace:terena.org:attribute-def

...

:schacHomeOrganization attribute

...

urn:mace:

...

surffederatie.nl:attribute-def:nlEduPersonOrgUnit

Multiplicity	multi-value
Description	Name of the department
Notes

...

urn:mace:

...

surffederatie.

...

nl:attribute-def:

...

nlEduPersonStudyBranch

Multiplicity	single multi-value
Description designation for the person's organisation using the organisation's domain name; syntax in accordance with RFC 1035	Study programme; numerical string containing the CROHO code. Empty if the programme is not a regular one.
Notes

urn:mace:

...

surffederatie.

...

nl:attribute-def:

...

nlStudielinkNummer

Multiplicity	single-value
Description designation	of the type of organisation to which a person belongs, using the values registered by Terena on: http://www.terena.org/registry/terena.org/schac/homeOrganizationType A student's Studielink number as registered at www.studielink.nl
Notes

...

urn:mace:surffederatie.nl:attribute

...

Nationally standardised attributes within SURFfederatie have been defined within the namespace urn:mace:surffederatie.nl:attribute-def. The name of all these attributes starts with the prefix "nl"

urn:mace:surffederatie.nl:attribute-def:nlEduPersonHomeOrganization

...

Multiplicity

...

single-value

...

Description

...

-def:nlDigitalAuthorIdentifier

Multiplicity	single-value
Description	Digital Author Identifier (DAI) as described here
Notes

The names of the attributes in the above table are the commonly used abbreviations. In the description below the attributes are listed using their full name. The SURFfederatie gateway will always provide the attributes by their full name. The attributes are defined in three different namespaces: urn:mace:dir:attribute-def, urn

...

Notes

...

:mace:terena.org:

...

schac and urn:mace:surffederatie.nl:attribute-def

...

.

Attributes defined in urn:mace:dir:attribute-def

Multiplicity	multi-value
Description	Name of the department
Notes

International standardised attributes according to the EduPerson schema have been defined within the namespace

urn:mace:

...

dir:attribute-def

...

Multiplicity	multi-value
Description	Study programme; numerical string containing the CROHO code. Empty if the programme is not a regular one.
Notes

urn:mace:surffederatie.nl:attribute-def:nlStudielinkNummer

Multiplicity	single-value
Description	A student's Studielink number as registered at www.studielink.nl
Notes

urn:mace:surffederatie.nl:attribute-def:nlDigitalAuthorIdentifier

...

Multiplicity

...

single-value

...

Description

...

Digital Author Identifier (DAI) as described here

...

Notes

...

: http://middleware.internet2.edu/urn-mace/urn-mace-dir-attribute-def.html. The version of the EduPerson schema used is: MACE-Dir/Educause, eduPerson Object Class Specification (200806), http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html, June 2008

Page tree

Page History

Versions Compared

Old Version 23

New Version 24

Key

Attribute overview

More information

Attributes

Detailed attribute descriptions

uid

Surname

Given name

Common name

Display name

Email address

urn:mace:dir:attribute-def:

eduPersonAffiliation

urn:mace:dir:attribute-def:

eduPersonEntitlement

urn:mace:dir:attribute-def:

Attributes overview

eduPersonPrincipalName

urn:mace:dir:attribute-def:preferredLanguage

Attributes defined in urn:mace:terena.org:attribute-def

urn:mace:terena.org:attribute-def:schacHomeOrganization

urn:mace:terena.org:

attribute-def:schacHomeOrganizationType

Attributes defined in urn:mace:surffederatie.nl:attribute-def

urn:mace:surffederatie.nl:attribute-def:nlEduPersonHomeOrganization

Detailed attribute descriptions

Attributes defined in urn:mace:dir:attribute-def

urn:mace:dir:attribute-def:uid

urn:mace:dir:attribute-def:sn

urn:mace:dir:attribute-def:givenName

urn:mace:dir:attribute-def:cn

urn:mace:dir:attribute-def:displayName

urn:mace:dir:attribute-def:mail

urn:mace:dir:attribute-def:eduPersonAffiliation

urn:mace:dir:attribute-def:eduPersonEntitlement

urn:mace:dir:attribute-def:eduPersonPrincipalName

urn:mace:dir:attribute-def:preferredLanguage

urn:mace:

surffederatie.nl:attribute-def:nlEduPersonOrgUnit

urn:mace:

surffederatie.

nl:attribute-def:

nlEduPersonStudyBranch

urn:mace:

surffederatie.

nl:attribute-def:

nlStudielinkNummer

urn:mace:surffederatie.nl:attribute

urn:mace:surffederatie.nl:attribute-def:nlEduPersonHomeOrganization

-def:nlDigitalAuthorIdentifier

Attributes defined in urn:mace:dir:attribute-def

urn:mace:surffederatie.nl:attribute-def:nlStudielinkNummer

urn:mace:surffederatie.nl:attribute-def:nlDigitalAuthorIdentifier