Page History

urn:mace

urn:mace:dir:attribute-def:sn

urn:oid

urn:oid:2.5.4.4

Multiplicity

single-valued

Description

The surname of a person (including any words such as “van”, “de”, “von” etc.) used for personalisationPersonalization; this can be a combination of existing attributes.

Notes

urn:mace

urn:mace:dir:attribute-def:mail

urn:oid

urn:oid:0.9.2342.19200300.100.1.3

Multiplicity

multi-valued

Description

e-mail address; syntax in accordance with RFC 5322

Notes

• Multiple email addresses are allowed. However, there's no clear strategy for SPs SP's on how to interpret multiple addresses (use both? pick one? ask user to pick one?); the SP should devise a strategy that makes sense within the context of the application. As an IdP, in the interest of interoperability, it's advisable to avoid sending multiple addresses where possible.
• An email address is not necessarily the email address of this person at the institution.
• Do not use this attribute to uniquely identify a user.  Use the NameId  instead.
• A user's email address may change over time, or an IdP may allow a user to change this value themselves. This makes that attribute unsuitable for authentication and authorization purposes.

urn:mace

urn:mace:terena.org:attribute-def:schacHomeOrganizationType

urn:oid

urn:oid:1.3.6.1.4.1.25178.1.2.10

Multiplicity

single-value

Description

designation of the type of organisation organization as defined on http://www.terena.org/registry/terena.org/schac/homeOrganizationType

Notes

• Attribute values are registered by Terena on http://www.terena.org/registry/terena.org/schac/homeOrganizationType
• In practice, this attribute is not/hardly used by IdPs or SPsIdP's or SP's
• Please contact support@surfconext.nl if you would like to use this attribute

urn:mace

urn:mace:dir:attribute-def:eduPersonAffiliation

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.1

Multiplicity

multi-valued

Description

Indicates the relationship between the user and his home organisation organization (institution). The following values are permitted within SURFconext:

• student — A person enrolled at an institution, an external student or course participant.
• employee — A person with a position at or labour labor agreement with an institution.
• staff — All academic staff and teachers. (deprecated; do not use in new deployments)
• faculty — A person whose primary role is teaching or research. (Commonly called WP at Dutch universities. Please note, PhD students are also perfectly allowed to carry this value.)
• member — Anyone that holds at least one of the above affiliations is also a member.
  
  
• pre-student — A person who has registered to start studying, but is not yet a full student. See this page (Dutch only) for more information about pre-students and the terms and conditions under which such users are allowed access. Pre-students will never be allowed access to service providers without prior consent from the service provider.
• affiliate — A person who is authorized by the Institution, pursuant to the lenience model concluded by the Institution, to use the Service.

Use the above mentioned definitions to determine which affiliation a user gets. If the definitions are not sufficient, please use common sense.

Notes

• Any user who has the affiliation student, employee, or faculty, should also have the value member.
• Identity Providers might internally use additional values for the affiliation attribute, such as alum. Per SURFconext policy, the IdP may not allow such users to access SURFconext.
  Other values mentioned in the eduPerson specification include library-walk-in. This value is not currently used within SURFconext.
• According to the eduPerson specification, the values of this attribute are case insensitive; for Interoperability reasons however, we require lower-case values as specified above in SURFconext.
• The document REFEDS eduPerson(Scoped)Affiliaton Affiliation usage comparison is useful to determine the usefulness of values in an international context.

Indicates the relationship between the user and the domain of his home organisationorganization. The affiliation part must be one of the allowed values of the eduPersonAffiliation attribute (see definition right above).

The value is the role of the user and the domain name of the organisation. eduPersonScopedAffiliation can hence be defined as: <eduPersonAffiliation> "@" <schacHomeOrganization>. Just like eduPersonScopedAffiliation, this is a multi valued attribute.

The domain part must be the schacHomeOrganization of the user (or a subdomain thereof). 

• This attribute is primarily a different way to convey the same information as is contained in eduPersonAffiliation and schacHomeOrganization. It's recommended to release this attribute next to eduPersonAffiliation and schacHomeOrganization, because some SPs SP's ask for this attribute instead of the two separate ones.
• If desired, this attribute can be used to describe the role of the user within a specific faculty, field, study or department that the user is part of. Because the attribute is multi-valued, a user can be a student at one and an employee at another department.

urn:mace

urn:mace:dir:attribute-def:eduPersonEntitlement

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.7

Multiplicity

multi-value

Description

entitlement; custom URI (URL or URN) that indicates an entitlement to something.

urn:mace:terena.org:tcs:personal-admin
urn:x-surfnet:surfdomeinen.nl:role:dnsadmin

Notes

• This attribute can be used to communicate entitlements, roles, etc, from identity providers to services, which can be used, for example, for authorization.
• The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
• Formatting rules apply: See also the SURFconext entitlement namespacing name-spacing policy.

urn:mace

urn:mace:dir:attribute-def:eduPersonPrincipalName

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.6

Multiplicity

single-valued

Description

Unique identifier for a user.  

Notes

• Although this value resembles an email address, it MUST NOT be used as an email address. In many cases mail cannot be delivered to this "address".
• Even though this value uniquely identifies a user, it is not guaranteed that it is persistent over sessions (even though it usually is).
• Preferedly do It is preferred to not use this to uniquely identify users.  Use the NameId instead.
• SURFconext will store the allowed domain part for your institution in our configuration so we can check that no illegal values are being sent.

urn:mace

urn:mace:dir:attribute-def:isMemberOf

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.5.1.1

Multiplicity

multi-valued

Description

Lists the collaborative organisations organizations the user is a member of.

Notes

• Attribute values are URIs (URN or URL)
• The only currently supported value is urn:collab:org:surf.nl, which indicated that the user's home institution is a member of SURFnet
• In the future, this can be used to determine membership of non-institutional collaborative organisationsorganizations.
• This attribute is generated by SURFconext and is available to SPsSP's; it should not be set by IdPsIdP's.

urn:mace

urn:mace:dir:attribute-def:eduPersonOrcid

urn:oid

urn:oid:1.3.6.1.4.1.5923.1.1.1.16

Multiplicity

multi-valued (see remark below)

URL, registered with ORCID.org

Description 

The ORCID is a persistent digital identifier that distinguishes the account holder from every other researcher. Through integration in research workflows such as manuscript and grant submission, the ORCID identifier supports automated linkages between the account holder and his/her professional activities ensuring that the account holder's work is recognized. Values MUST be valid ORCID identifiers in the ORCID - preferred URL representation, i.e. http://orcid.org/0000-0002-1825-0097

http://orcid.org/0000-0002-1825-0097

http://orcid.org/0000-0001-9351-8252

Notes 

For more information see https://www.surf.nl/en/news/2016/02/global-author-identifier-service-orcid-now-available-through-surfconext-and-edugain.html

Although the attribute is in theory multi-valued, in practice it probably makes sense that it has no more than one value.