Page History

Considerations for SAML eduID.at SAML Identity Providers for use with services registered with other Identity Federations via Interfederation arrangements (such as eduGAIN).

Rationale

Only by (also) participating in Interfederation will you be able to support your academic constituency in providing them with secured access to the resources they need. For example E-Research or Student Mobility cannot happen without international collaboration and shared, properly managed access to scientific tools or administrative applications. Cf. the FIM4R (Federated Identity Management for Research Collaborations) paper.

Metadata

All IDPs in eduID.at should always load SAML Metadata that also includes entities known via Interfederation agreements, such as eduGAIN. This metadata set alone is sufficient for all eduID.at Federation and Interfederation purposes, so can replace any previously used one:

As always, use the provided Metadata Verification Key to make sure the metadata is authentic and hasn't been tempered tampered with.

Make attributes available

Adjust the IDP configuration to lookup and/or generate any missing attributes. You'll find copy/paste-able examples for all of those in our IDP 4 Attribute resolution documentation.

• Name attributes
  • displayName (urn:oid:2.16.840.1.113730.3.1.241)
  • givenName (urn:oid:2.5.4.42)
  • sn/surname (urn:oid:2.5.4.4)
• Identifiers
  • SAML Subject-ID (urn:oasis:names:tc:SAML:attribute:subject-id)
  • SAML Pairwise-ID (urn:oasis:names:tc:SAML:attribute:pairwise-id)
  • SAML2 persistent NameID (urn:oasis:names:tc:SAML:2.0:nameid-format:persistenteduPersonTargetedID (a.k.a. SAML2 persistent NameID, urn:oid:1.3.6.1.4.1.5923.1.1.1.10)
  • eduPersonPrincipalName (urn:oid:1.3.6.1.4.1.5923.1.1.1.6)
  • mail (urn:oid:0.9.2342.19200300.100.1.3)
  • European Student Identifier by means of specific schacPersonalUniqueCode attribute values, where applicable (tertiary education students)
• Authorization / Org data
  • eduPersonScopedAffiliation (urn:oid:1.3.6.1.4.1.5923.1.1.1.9)
  • eduPersonEntitlement (urn:oid:1.3.6.1.4.1.5923.1.1.1.7)
  Organizational data
  • schacHomeOrganization (urn:oid:1.3.6.1.4.1.25178.1.2.9)

Attribute release

Extend your existing IDP configuration to scalably release needed attributes to appropriate Service Providers.
IDP attribute release configuration to make use of Service Categories, to enable scalable and controlled attribute release.

...

Be sure to test your attribute release rules with the eduGAIN Attribute Release Check!

Notify ACOnet

To make your Identity Provider usable with services registered in other federations contact ACOnet in order for your entity to become visible to those interfederation services.

If you added support for Service Categories-based attribute release (which is strongly recommended) please also notify ACOnet about which ones you support, so this can be documented in your Identity Provider's SAML Metadata. Signalling the support for a given Service Category allows services relying on attributes defined in such Service Categories to automatically filter which IDPs they to make available for login. By only listing IDPs who that claim to support a given Service Category chances of successful logins (and hence of a proper user experience) for subjects coming from those Identity Providers are greatly enhanced! Conversely, IDPs not announcing support for any of the popular Service Categories (i.e., those giving the Service Providers no indication that necessary attributes will be released) might sometimes find themselfs unable to access some of these services, even if the IDP would release the needed attributes.