Page tree
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 10 Next »

User identifiers

When a user logs in to a service provider, SURFconext sends a so-called SAML assertion to the service provider.  In this SAML assertion, the identity of the current user is asserted.  The SAML assertion contains an identifier for the user, the so-called NameId.

SURFconext can provide NameIds of three different types:

  • A persistent identifier.  A persistsent NameId contains a random string that uniquely identifies the user for this SP, and which is persistent over sessions. 
  • A transient identifier.  A transient NameId contain a random string that uniquely identifies the user for this SP during the session.  Once the user's session at SURFconext expires, a new transient identifier will be generated for the user and SP.
  • A legacy identifier.  A legacy NameId contains a human-readable dentifier of the form urn:collab:person:example.com:johndoe.  This form of the identifier is deprecated and is not available for newly connected services. Leg uit waarom

Persistent and transient identifiers are typically of the form "bd09168cf0c2e675b2def0ade6f50b7d4bb4aaef".  However, this form may change in the future, and service providers MUST NOT rely on the fact that the NameId is a 40-character hexadecimal string.

This definition follows the SAML2int standard. The two supported NameId types are

  • urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
  • urn:oasis:names:tc:SAML:2.0:nameid-format:transient

which are specified in sections 8.3.7 and 8.3.8 of the SAML2 core specification.

SPs

The following attributes are available for SPs that connect to SURFconext

Friendly name

Attribute name

Definition

Data type

Example

Remarks

ID

(NameId)
urn:oid:1.3.6.1.4.1.5923.1.1.1.10

eduPerson

Random string

bd09168cf0c2e675b2def0ade6f50b7d4bb4aaef

 

Surname

urn:mace:dir:attribute-def:sn
urn:oid:2.5.4.4

X.520

Unicode string

 

 

Given name

urn:mace:dir:attribute-def:givenName
urn:oid:2.5.4.42

X.520

 

 

 

Common name

urn:mace:dir:attribute-def:cn
urn:oid:2.5.4.3

X.520

 

 

 

Display name

urn:mace:dir:attribute-def:displayName
urn:oid:1.3.6.1.4.1.1466.115.121.1.15

RFC2798

 

 

 

Email address

urn:mace:dir:attribute-def:mail
urn:oid:0.9.2342.19200300.100.1.3

RFC4524

 

 

 

Organization

urn:mace:terena.org:attribute-def:schacHomeOrganization
urn:oid:1.3.6.1.4.1.1466.115.121.1.15

Schac

 

 

 

Organization Type

urn:mace:terena.org:attribute-def:schacHomeOrganizationType
urn:oid:1.3.6.1.4.1.1466.115.121.1.15

Schac

 

 

 

Affiliation

urn:mace:dir:attribute-def:eduPersonAffiliation
urn:oid:1.3.6.1.4.1.5923.1.1.1.1

eduPerson

 

 

 

Entitlement

urn:mace:dir:attribute-def:eduPersonEntitlement
urn:oid:1.3.6.1.4.1.5923.1.1.1.7

eduPerson

 

 

 

PrincipalName

urn:mace:dir:attribute-def:eduPersonPrincipalName
urn:oid:1.3.6.1.4.1.5923.1.1.1.6

eduPerson

 

 

 

isMemberOf

urn:mace:dir:attribute-def:isMemberOf (not defined?!)
urn:oid:1.3.6.1.4.1.5923.1.5.1.1

Internet2

 

 

 

uid

urn:mace:dir:attribute-def:uid
urn:oid:1.3.6.1.4.1.1466.115.121.1.15

RFC4519

 

 

 

preferredLanguage

urn:mace:dir:attribute-def:preferredLanguage
urn:oid:1.3.6.1.4.1.1466.115.121.1.15 (not sure?)

RFC2798

 

 

 

More information

http://www.incommon.org/federation/attributesummary.html
saml2int.org

Attributes

The following attributes can be included in the response from SURFconext to the service provider. They contain information about the authenticated user. This will make it possible for the service to for instance show the "displayName" of the user in the interface or determine the affiliation of the user for authorization. For instance a student has a different view than a teacher.

Attribute

Attribute (OID)

Example

Remarks

urn:mace:dir:attribute-def:displayName

urn:oid:2.16.840.1.113730.3.1.241

John Doe

Usually this is equal to cn.

urn:mace:dir:attribute-def:mail

urn:oid:0.9.2342.19200300.100.1.3

john@example.org

This attribute can contain multiple email addresses.

urn:mace:dir:attribute-def:sn

urn:oid:2.5.4.4

Doe

 

urn:mace:dir:attribute-def:cn

urn:oid:2.5.4.3

John Doe

 

urn:mace:dir:attribute-def:givenName

urn:oid:2.5.4.42

John

 

urn:mace:dir:attribute-def:eduPersonPrincipalName

urn:oid:1.3.6.1.4.1.5923.1.1.1.6

john_doe@example.org

This is not necessarily a valid email address!

urn:mace:terena.org:attribute-def:schacHomeOrganization

urn:oid:1.3.6.1.4.1.1466.115.121.1.15

example.org

 

urn:mace:dir:attribute-def:uid

urn:oid:0.9.2342.19200300.100.1.1

john_doe

You should not use this for (unique) user identification purposes in your service!

urn:mace:dir:attribute-def:eduPersonAffiliation

urn:oid:1.3.6.1.4.1.5923.1.1.1.1

student

Supported values: employee, student and affiliate.

urn:mace:dir:attribute-def:isMemberOf

urn:oid:1.3.6.1.4.1.5923.1.5.1.1

urn:collab:org:surf.nl

Contact us before you want to use this attribute!

In order to uniquely identify a user the persistent Name ID value can be used. This value can be extracted from the Name ID and is also available in the attribute urn:mace:dir:attribute-def:eduPersonTargetedID (urn:oid:1.3.6.1.4.1.5923.1.1.1.10) if the SAML software does not support extracting Name ID values.

Currently we convert schacHomeOrganization to the wrong OID. The correct value is urn:oid:1.3.6.1.4.1.25178.1.2.9. This will be fixed soonish.

UID is the unique identifier of the user at the home institution, it is not unique for all users in SURFconext! Use eduPersonTargetedID (preferred) or eduPersonPrincipalName if you need to uniquely identify users.

A service provider SHOULD only at most request the following attributes, requesting these and any other attributes MUST BE accompanied by an explanation of why they are needed:

  • urn:mace:dir:attribute-def:displayName
  • urn:mace:dir:attribute-def:mail
  • urn:mace:dir:attribute-def:cn
  • urn:mace:dir:attribute-def:eduPersonAffiliation
  • urn:mace:terena.org:attribute-def:schacHomeOrganization

The attributes are available in both human readable format and OID format. See also this eduGAIN recommendation.

Ultimately it is up to the identity provider and service provider to agree on a set of attributes to be released by the IdP, SURFconext only mediates. However, it is strongly recommend to stick to the above attributes as they are standardized and ensure greater interoperability.

The table below lists the attributes that have been defined for use within SURFfederatie. This list was created in consultation with the connected institutions, specifically within the 3TU partnership. With a view to the expected future international collaboration, this table is largely based on the EduPerson and SCHAC tables. A number of attributes that are specific to SURFfederatie and the Netherlands have been added.

Note that the attributes described on this page are the standardised attributes that an identity provider may provide to the SURFnet federation gateway. If you are a service provider connecting to SURFconext, please refer to the attribute description on ?Authentication using SAML page.

Attributes overview

A more detailed description of each attribute can be found in the next section.

Attribute Name
(abbreviated)

Description

Example value(s)

 

uid

user id/login name

joebloggs

4236712

sn

surname

Bloggs

Smith

givenName

given name

Joe

Prof. H.A.B.

cn

full name

Joseph Bloggs

 

displayName

display name

Joey

 

mail

e-mail address

j.bloggs@rug.nl

H.A.B.Smith@tudelft.nl
smith_78@hotmail.com

eduPersonAffiliation

affiliation type

student

employee

eduPersonEntitlement

entitlement

?depends on service provider

 

eduPersonPrincipalName

unique name

joebloggs@rug.nl

 

preferredLanguage

preferred language

nl

en

schacHomeOrganization

domain name

tudelft.nl

 

schacHomeOrganizationType

type of organisation

urn:mace:terena.org:schac: homeOrganizationType:eu: higherEducationInstitution

 

nlEduPersonHomeOrganization
(deprecated)

name of institution

Delft University of Technology

Utrecht University of Applied Sciences

nlEduPersonStudyBranch

ROHO code

52734

 

nlEduPersonOrgUnit

department name

Faculty of Humanities

Library

nlStudielinkNummer

studielink number

xxxxxxxxxx

 

nlDigitalAuthorIdentifier

DAI number

070014345

 

Detailed attribute descriptions

The names of the attributes in the above table are the commonly used abbreviations. In the description below the attributes are listed using their full name. The SURFfederatie gateway will always provide the attributes by their full name. The attributes are defined in three different namespaces: urn:mace:dir:attribute-def, urn:mace:terena.org:schac and urn:mace:surffederatie.nl:attribute-def.

Attributes defined in urn:mace:dir:attribute-def

International standardised attributes according to the EduPerson schema have been defined within the namespace urn:mace:dir:attribute-def: http://middleware.internet2.edu/urn-mace/urn-mace-dir-attribute-def.html. The version of the EduPerson  schema used is: MACE-Dir/Educause, eduPerson Object Class Specification (200806), http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html, June 2008

urn:mace:dir:attribute-def:uid

Multiplicity

single-value

Description

The unique code for a person that is used as the login name within the institution.

Notes

  • Ideally the uid is not only a login name/code but also an identifier that is guaranteed as being unique within the institution over the course of time. At the moment, there is no such guarantee.
  • Use the eduPersonPrincipalName attribute if uniqueness over multiple institutions is required.
  • A uid may contain any unicode character. E.g. "org:surfnet.nl:joe" is a valid uid.

urn:mace:dir:attribute-def:sn

Multiplicity

single-value

Description

The surname of a person (including any words such as "van", "de", "von" etc.) used for personalisation; this can be a combination of existing attributes.

Notes

 

urn:mace:dir:attribute-def:givenName

Multiplicity

single-value

Description

Given name / "name known by"; combinations of title, initials, and "name known by" are possible.

Notes

 

urn:mace:dir:attribute-def:cn

Multiplicity

single-value

Description

Full given name.

Notes


urn:mace:dir:attribute-def:displayName

Multiplicity

single-value

Description

Display name as displayed in applications

Notes

 

urn:mace:dir:attribute-def:mail

Multiplicity

multi-value

Description

e-mail address; syntax in accordance with RFC 1274 and RFC 822.

Notes

  • This is a multi-value attribute.
  • An email address is not necessarily the email address of this person at the institution, it can also be a @google.com, @hotmail.com or @vanitydomain.org address.
  • The mail may change over time for a user, also an IdP may allow a user to set this value. This makes that attribute unsuitable for authentication and authorization purposes.

urn:mace:dir:attribute-def:eduPersonAffiliation

Multiplicity

multi-value

Description

indicates the relationship between the user and his/her own organisation; possible values:

  • student - student
  • employee - all employees
  • staff - academic staff
  • alum - alumnus
  • affiliate - third party; no direct work relationship with the institution (either paid or unpaid)

Notes

Note that you must not allow alum or affiliate users to access SURFfederatie. Providing this attribute is not sufficient to deny these users access to SURFfederatie as many service providers do not receive this attribute. Please contact federatie-beheer@surfnet.nl if you have questions about this.

urn:mace:dir:attribute-def:eduPersonEntitlement

Multiplicity

multi-value

Description

entitlement; URI (URL or URN) that indicates an entitlement to something; is determined by a contract between the service provider and the institution.

Notes

 

urn:mace:dir:attribute-def:eduPersonPrincipalName

Multiplicity

single-value

Description

Unique "net ID" beyond the scope of the particular institution, in the form "<user>@<scope>".E.g. "s012001234@student.example.com".

Notes

  • Although this value resembles an email address, it should not be used as such. In many cases mail cannot be delivered to this "address".
  • This value should never be reassigned to another user. I.e. after a user leaves an institution, it should not be assigned to another (future) user.

urn:mace:dir:attribute-def:preferredLanguage

Multiplicity

single-value

Description

a two-letter abbreviation for the preferred language according to the ISO 639 language abbreviation code table; no subcodes.

Notes

 

Attributes defined in urn:mace:terena.org:attribute-def

International standardised attributes according to the Terena SCHAC schema have been defined within the namespace urn:mace:terena.org:schac: http://www.terena.org/activities/tf-emc2/schacreleases.html. The version of the SCHAC table used is 1.3.0 (12 December 2006).

urn:mace:terena.org:attribute-def:schacHomeOrganization

Multiplicity

single-value

Description

designation for the person's organisation using the organisation's domain name; syntax in accordance with RFC 1035.

Notes

 

urn:mace:terena.org:attribute-def:schacHomeOrganizationType

Multiplicity

single-value

Description

designation of the type of organisation to which a person belongs, using the values registered by Terena on: http://www.terena.org/registry/terena.org/schac/homeOrganizationType

Notes

 

Attributes defined in urn:mace:surffederatie.nl:attribute-def

Nationally standardised attributes within SURFfederatie have been defined within the namespace urn:mace:surffederatie.nl:attribute-def. The name of all these attributes starts with the prefix "nl"

urn:mace:surffederatie.nl:attribute-def:nlEduPersonHomeOrganization

Multiplicity

single-value

Description

 

Notes

This attribute is deprecated. It has been replaced by the urn:mace:terena.org:attribute-def:schacHomeOrganization attribute

urn:mace:surffederatie.nl:attribute-def:nlEduPersonOrgUnit

Multiplicity

multi-value

Description

Name of the department

Notes

 

urn:mace:surffederatie.nl:attribute-def:nlEduPersonStudyBranch

Multiplicity

multi-value

Description

Study programme; numerical string containing the CROHO code. Empty if the programme is not a regular one.

Notes

 

urn:mace:surffederatie.nl:attribute-def:nlStudielinkNummer

Multiplicity

single-value

Description

A student's Studielink number as registered at www.studielink.nl

Notes

 

urn:mace:surffederatie.nl:attribute-def:nlDigitalAuthorIdentifier

Multiplicity

single-value

Description

Digital Author Identifier (DAI) as described here

Notes

 

  • No labels