Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: update ePSA def

...

Friendly name

Attribute name

Definition

Data type

Example

ID

(NameID)
urn:mace:dir:attribute-def:eduPersonTargetedID
urn:oid:1.3.6.1.4.1.5923.1.1.1.10

eduPerson (1)

UTF8 string
(unbounded)

bd09168cf0c2e675b2def0ade6f50b7d4bb4aae

Surname

urn:mace:dir:attribute-def:sn
urn:oid:2.5.4.4

X.520

UTF8 string
(unbounded)

Vermeegen
孝慈

Given name

urn:mace:dir:attribute-def:givenName
urn:oid:2.5.4.42

X.520

UTF8 string
(unbounded)

Mërgim Lukáš
Þrúður

Common name

urn:mace:dir:attribute-def:cn
urn:oid:2.5.4.3

X.520

UTF8 String
(unbounded)

Prof.dr. Mërgim Lukáš Vermeegen
加来 千代, PhD.

Display name

urn:mace:dir:attribute-def:displayName
urn:oid:2.16.840.1.113730.3.1.241

RFC2798

UTF8 String
(unbounded)

Prof.dr. Mërgim L. Vermeegen
加来 千代, PhD.

Email address

urn:mace:dir:attribute-def:mail
urn:oid:0.9.2342.19200300.100.1.3

RFC4524

RFC-5322 address
(max 256 chars)

m.l.vermeegen@university.example.org
maarten.'t.hart@uniharderwijk.nl 
"very.unusual.@.but valid.nonetheless"@example.com
mlv@[IPv6:2001:db8::1234:4321]

Organization

urn:mace:terena.org:attribute-def:schacHomeOrganization
urn:oid:1.3.6.1.4.1.25178.1.2.9

Schac

RFC-1035 domain string

example.nl
something.example.org  

Organization Type

urn:mace:terena.org:attribute-def:schacHomeOrganizationType
urn:oid:1.3.6.1.4.1.25178.1.2.10

Schac

RFC-2141 URN
see Schac standard  

urn:mace:terena.org:schac:homeOrganizationType:int:university
urn:mace:terena.org:schac:homeOrganizationType:es:opi

Employee/student number

urn:schac:attribute-def:schacPersonalUniqueCode
urn:oid:1.3.6.1.4.1.25178.1.2.14

Schac

RFC-2141 URN
see SURFnet registry 

urn:schac:personalUniqueCode:nl:local:example.edu:employeeid:x12-3456
urn:schac:personalUniqueCode:nl:local:example.nl:studentid:s1234567

Affiliation

urn:mace:dir:attribute-def:eduPersonAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.1

eduPerson (1)

Enum type (UTF8 String)

employee, student, faculty, member, affiliate, pre-student
(staff is deprecated; library-walk-in, alum are not allowed)

Scoped affiliationurn:mace:dir:attribute-def:eduPersonScopedAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.9
eduPerson (1)UTF8 String
user@domain

student@physicsstudent@uniharderwijk.uniharderwijk.nl
employee@facilitiesemployee@uniharderwijk.uniharderwijk.nl

Entitlement

urn:mace:dir:attribute-def:eduPersonEntitlement
urn:oid:1.3.6.1.4.1.5923.1.1.1.7

eduPerson (1)

RFC-2141 URN
Multi-valued

to be determined per service (see Standardized values for eduPersonEntitlement)

PrincipalName

urn:mace:dir:attribute-def:eduPersonPrincipalName
urn:oid:1.3.6.1.4.1.5923.1.1.1.6

eduPerson (1)

UTF8 String
user@domain

piet.jønsen@example.edu
not.a@vålîd.émail.addreß

isMemberOf

urn:mace:dir:attribute-def:isMemberOf
urn:oid:1.3.6.1.4.1.5923.1.5.1.1

eduMember

RFC-2141 URN
Multi-valued

urn:collab:org:surf.nl
urn:collab:org:clarin.org

uid

urn:mace:dir:attribute-def:uid
urn:oid:0.9.2342.19200300.100.1.1

RFC4519

UTF8 String
(max 256 chars)

s9603145
flåp@example.edu

preferredLanguage

urn:mace:dir:attribute-def:preferredLanguage
urn:oid:2.16.840.1.113730.3.1.39

RFC2798
BCP47

List of BCP47 language tags

nl
nl, en-gb;q=0.8, en;q=0.7

ORCID

urn:mace:dir:attribute-def:eduPersonORCID

urn:oid:1.3.6.1.4.1.5923.1.1.1.16

eduPerson (1)

URL registered

with ORCID.org

http://orcid.org/0000-0002-1825-0097

...

Anchor
ePSA
ePSA
Scoped Affiliation

urn:maceurn:mace:dir:attribute-def:eduPersonScopedAffiliation
urn:oidurn:oid:1.3.6.1.4.1.
5923
1466.
1
115.
1
121.1.
9 
15
Multiplicitymulti-valued
Data typeUTF8 String of the form
affiliation@subdomain
affiliation@domain (see below)
Description

Indicates the relationship between the user and

a specific (security) domain with

the domain of his home organisation.

  The values consist of an affiliation and a security domain, concatenated with a @-sign, i.e. <affiliation>@<sub.domain.nl>. In this way, the relationship between a user and his institution can be specified in a fine-grained way. For example, it allows for specification that a user is a student in the Physics department, or a secretary works in a specific department within a faculty.

The affiliation-part must be one of the values allowed for the eduPersonAffiliation attribute (see above).

The domain-part of this attribute must be subdomain of the user's schacHomeOrganization. This subdomain does not necessarily need to exist in DNS. For example, if the user's university uses the schacHomeOrganization uniharderwijk.nl, valid values for the domain part of the eduPersonScopedAffiliation would be science.uniharderwijk.nl, physics.science.uniharderwijk.nl, etc.

Examples

student@physics.uniharderwijk.nl
employee@catering.facilities.uniharderwijk.nl
faculty@bio.uniharderwijk.nl

Notes

  • This attribute can be used to express the faculty, field of study, department, etc. to which a user is affiliated.
  • As this attribute is multivalued, it is easily possible to express that a user is a student in a certain field, and at the same time is employed by a different department of the university
  • There is no common register or policy of which subdomains are valid or express a certain concept. For example, employee@cs.uniharderwijk.nl might indicate the user is a staff member of the computer science department of the University of Harderwijk, while employee@cs.surfnet.nl might indicate an employee of the community support department of SURFnet. Therefore, if you are an SP and would like to use this attribute, you always need to confer with the university if you need to interpret these values.

    The affiliation part must be one of the allowed values of the eduPersonAffiliation attribute (see definition right above).

    The value is the role of the user and the domain name of the organisation. eduPersonScopedAffiliation can hence be defined as: <eduPersonAffiliation> "@" <schacHomeOrganization>. Just like eduPersonScopedAffiliation, this is a multi valued attribute.

    The domain part must be the schacHomeOrganization of the user (or a subdomain thereof). 

    Examplesstudent@uniharderwijk.nl
    faculty@uniharderwijk.nl
    Notes
    • This attribute is primarily a different way to convey the same information as is contained in eduPersonAffiliation and schacHomeOrganization. It's recommended to release this attribute next to eduPersonAffiliation and schacHomeOrganization, because some SPs ask for this attribute instead of the two separate ones.
    • If desired, this attribute can be used to describe the role of the user within a specific faculty, field, study or department that the user is part of. Because the attribute is multi-valued, a user can be a student at one and an employee at another department.

     

    Anchor
    ePE
    ePE
    Entitlements

    urn:mace

    urn:mace:dir:attribute-def:eduPersonEntitlement

    urn:oid

    urn:oid:1.3.6.1.4.1.5923.1.1.1.7

    Multiplicity

    multi-value

    Data typeRFC-2141 URN

    Description

    entitlement; custom URI (URL or URN) that indicates an entitlement to something.

    Examples

    urn:mace:terena.org:tcs:personal-admin
    urn:x-surfnet:surfdomeinen.nl:role:dnsadmin

    Notes

    • This attribute can be used to communicate entitlements, roles, etc, from identity providers to services, which can be used, for example, for authorization.
    • The values of this attribute are scoped to the identity provider that is authoritative for the attribute. 
    • Formatting rules apply: See also the SURFconext entitlement namespacing policy.

    ...