Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

As specified by the MyAcademicID team the "MyAcademicID IAM Service" requires a specific set of data in order for logins to the services "behind" it to be possible. While it would be pointless to repeat this specification here we can provide guidance to the local eduID.at Austrian academic community by sharing copy/paste-able instructions on how to enable access to the central component and thereby to all the services "behind" it. This assumes use of the Shibboleth Identity Provider software and a configuration that matches our own documentation and deployment recommendations, specifically the attribute resolver and attribute filter documentation.

...

In support of these larger projects the European Student Identifier (ESI) was defined and this too needs to be made available in your IDP and released to the central "MyAcademicID IAM Service". Copy/paste-able examples for its creation are part of our standard set of documentation for the Shibboleth IDP's attribute resolver as well as for its scalable release to eligible services.

Erasmus Without Paper admins

Selected individiduals from your institution may need to be provided with a specific eduPersonEntitlement attribute value in order to access certain EWP-specific resources. The section "Attribute release configuration" below illustrates just that, though assigning it to specific people and creating it within your Shibboleth IDP's attribute resolver also needs to happen.

Other common attributes

Make sure to also have the common attributes displayName, mail, eduPersonScopedAffiliation and schacHomeOrganization available and release them to the "MyAcademicID IAM Service", all of which we already provide extensive configuration guidance for.

...

Tip

An easy way to test your attribute release configuration for Erasmus+ services is the MyAcademicID Attribute Release Test Service. Alternatively testing attribute release policies on the command line of your Shibboleth IDP server using the aacli tool is fast and easy (though you'd have to interpret the results yourself, compating comparing the set of attribute shown by the aacli (that would be release released) against the published requirements of the "MyAcademicID IAM Service" . (See see "Attribute requirements") above.)


Note

We're assuming you've already configured support for releasing the SAML SubjectID Profile Attributes (SAML Pairwise-ID or SAML Subject-ID) in a scalable way according to our documentation (cf. section "Identifiers" above). Otherwise you'd have to add AttributeRule elements for samlPairwiseID (or if you can't support that, for samlSubjectID) to your attribute release rule specific to the "MyAcademicID IAM Service".

...

Include Page
IDP 4 include-ESIMyAcacemicID-rules
IDP 4 include-ESIMyAcacemicID-rules