Versions Compared

Old Version 2

changes.mady.by.user Lukas Haemmerle

Saved on

compared with

New Version 3

changes.mady.by.user Šliamin Andrėj

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The Data protection Code of Conducts (CoCo) enables safe attribute release between Identity and Service Providers within EU.

This page explains how an Identity Provider can implement the GÉANT Data Protection Code of Conduct in order to safely release attributes about its users.

  1. Read and understand the GÉANT Data Protection Code of Conduct for SPs:
  2. Develop a maximum list of attributes that the Home Organisation (the organization responsible for the IdP server) is willing to release to an SP committed to the Code of Conduct
    • An approach to limit the Home Organisation’s data protection risks is to release only innocuous attributes to the SP
    • The list is a maximum list of attributes. If the SP requests fewer attributes, it is going to receive only those requested
    • Especially, the Home Organisation should not release personal data the data protection laws define sensitive (attributes revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and attributes concerning health or sex life)
    • On the other hand, releasing too few attributes may lead to the end user being denied access to the SP
    • c.f. the eduGAIN attribute profile recommends Home Organisations to populate the following attributes: displayName, cn, mail, eduPersonAffiliation, eduPersonScopedAffiliation, eduPersonPrincipalName, SAML2 Persistent NameID (eduPersonTargetedID), schacHomeOrganization and schacHomeOrganizationType
  3. Find out if your Home Organisation is willing to release attributes to an SP committed to the CoCo
    • You need to identify the person to make that decision. The person must have the right to do the decision.
    • The person needs to be able to balance the risks (attribute release leading to a data protection problem) with the benefits (the potential of easier scientific collaboration which may lead to an increased scientific output of the institution)
    • The person can be for instance a CIO or information manager responsible for identity management
    • The person may need security consultation by the security manager and legal consultation by a lawyer or other person familiar with the data protection laws
  4. Consider deploying an attribute release UI to the IdP server for informing the end user
  5. Configure your Home Organisation’s IdP server to