When a user logs in to a service provider, SURFconext sends a so-called SAML assertion to the service provider. This SAML assertion contains a number of statements about the user who is logging in to you service, including his identity, and possibly a number of additional attributes (see below). More information about SAML can be found on this page.
On this page, we explain which attributes SURFconext and its identity providers can provide for the services. A guide for identity providers, explaining which attributes should be released to SURFconext, is found elsewhere.
User identifiers
The user's identity is transmitted in the form of the NameId element of the SAML statement. SPs should use the NameId (rather than email address, or other attributes that might change over time) to identify users. The NameId is guaranteed to be stable and never change for a fixed user (except in the case of transient identifiers, see below).
...
The legacy format is not standardized, and currently has the type urn:oasis:names:tc:SAML:21.01:nameid-format:unspecified.
...
Friendly name | Attribute name | Definition | Data type | Example | |
|---|---|---|---|---|---|
ID | (NameId) | UTF8 string | bd09168cf0c2e675b2def0ade6f50b7d4bb4aae | ||
Surname | UTF8 string | Vermeegen | |||
Given name | UTF8 string | Mërgim Lukáš | |||
Common name | UTF8 String | Prof.dr. Mërgim Lukáš Vermeegen | |||
Display name | urn:mace:dir:attribute-def:displayName | UTF8 String | Prof.dr. Mërgim L. Vermeegen | ||
Email address | urn:mace:dir:attribute-def:mail | RFC-5322 address | m.l.vermeegen@university.example.org | ]]></ac:plain-text-body></ac:structured-macro> | |
Organization | urn:mace:terena.org:attribute-def:schacHomeOrganization | RFC-1035 domain string | university.example.org | ||
Organization Type | urn:mace:terena.org:attribute-def:schacHomeOrganizationType | RFC-2141 URN | urn:mace:terena.org:schac:homeOrganizationType:int:university | ||
Affiliation | urn:mace:dir:attribute-def:eduPersonAffiliation | Enum type (UTF8 String) | faculty, student, staff, alum, member, affiliate, employee, library-walk-in | ||
Entitlement | urn:mace:dir:attribute-def:eduPersonEntitlement | RFC-2141 URN | to be determined | ||
PrincipalName | urn:mace:dir:attribute-def:eduPersonPrincipalName | UTF8 String | not.a@vålîd.émail.addreß | ||
isMemberOf | urn:mace:dir:attribute-def:isMemberOf | RFC-2141 URN | urn:collab:org:surf.nl | ||
uid | urn:mace:dir:attribute-def:uid | UTF8 String | s9603145 | ||
preferredLanguage | urn:mace:dir:attribute-def:preferredLanguage | BCP47 language tag | nl-BE |
...