Preparing an IDP for Interfederation

Considerations for SAML Identity Providers for use with services registered with other Identity Federations via Interfederation arrangements (such as eduGAIN).

Metadata

IDPs in eduID.at can always load SAML Metadata that also includes entities known via Interfederation agreements, such as eduGAIN:

As always, use the provided Metadata Verification Key to make sure the metadata is authentic and hasn't been tempered with.

Make attributes available

Adjust the IDP configuration to lookup and/or generate any potentially missing attributes. All eduID.at-registered IDPs should be able to produce the following attributes:

• Name attributes
  • displayName (urn:oid:2.16.840.1.113730.3.1.241)
  • givenName (urn:oid:2.5.4.42)
  • sn (urn:oid:2.5.4.4)
• Identifiers
  • eduPersonTargetedID (a.k.a. SAML2 persistent NameID, urn:oid:1.3.6.1.4.1.5923.1.1.1.10)
  • eduPersonPrincipalName (urn:oid:1.3.6.1.4.1.5923.1.1.1.6)
  • mail (urn:oid:0.9.2342.19200300.100.1.3)
• Authorization
  • eduPersonScopedAffiliation (urn:oid:1.3.6.1.4.1.5923.1.1.1.9)
  • eduPersonEntitlement (urn:oid:1.3.6.1.4.1.5923.1.1.1.7)
• Organizational data
  • schacHomeOrganization (urn:oid:1.3.6.1.4.1.25178.1.2.9)

Attribute release

Adjust the IDP configuration to scalably release selected attributes to appropriate SPs.

TODO: Detailed technical information to follow!

Notify ACOnet

To make your Identity Provider usable with Services from other interfederated institutions contact ACOnet in order for your entity to become visible to eduGAIN (and from there to other eduGAIN-participating federations).