Versions Compared
Key
- This line was added.
- This line was removed.
- Formatting was changed.
| Tip | ||
|---|---|---|
| ||
The |
...
GEANT AAI Service supports the Research and Scholarship (R&S) Entity Category. As such, |
...
GEANT AAI Service expects to receive the R&S attribute bundle from IdPs in eduGAIN supporting the R&S Entity Category. |
| Tip | ||
|---|---|---|
| ||
As a service that meets the requirements for and supports the entity category of Code of Conduct, the service specifically declares the attributes it requires. |
| Attribute Type | Attribute | Requirement | Explanation |
|---|---|---|---|
| User Identifier |
| Mandatory (at least one) |
...
GEANT AAI Service and the services connected through |
...
GEANT AAI Service require to uniquely identify users. Without a unique identifier, it is not possible to distinguish two different users between each other. As a service that supports Sirtfi, it is required that it is able to uniquely identify users. 1 The i) the IdP supports the R&S Enitity Category, ii) the iii) the federation in which the IdP has registered has a policy that prohibits the reassignment of the value of the |
|
|
|
|
...
Access to the services connected through MyAccessID will be dominantly supported by identities coming from the IdPs from the R&E sector and eduGAIN.
...
Name |
| Mandatory (at least one) |
...
GEANT AAI Service and the services connected through |
...
GEANT AAI Service expect to receive the name of the user. For example, when a user applies for a new project or for membership membership to an existing project, the managers need to be able to recognise who the applicant is. | ||
displayName | ||
| ||
| Mandatory |
...
GEANT AAI Service needs to be able to contact the user regarding the status of their account. In addition, many of the services connected through |
...
GEANT AAI Service expect the email of the user in order to be able contact the user about service related matters. |
...
| Organization |
...
schacHomeOrganization |
...
| Optional | Access to many of the services connected through |
...
GEANT AAI Service relies on authorising |
...
users based on |
...
their home organisation. |
...
| Entitlements |
...
| eduPersonEntitlement | Optional |
...
Service specific entitlements that may be required in order to access specific services. |
Depending on which protocol the IdP is using, SAML or OIDC, attributes need to be released in the following format, respectively:
- SAML Attribute Names
SAML Attributes MUST be sent using urn:oasis:names:tc:SAML:2.0:attrname-format:uri NameFormat. Below is the list of the canonical names of the SAML attributes:
| SAML Attribute Name | SAML Attribute Friendly Name |
|---|---|
urn:oasis:names:tc:SAML:attribute:subject-id | subject-id |
urn:oasis:names:tc:SAML:attribute:pairwise-id | pairwise-id |
urn:oid:0.9.2342.19200300.100.1.3 | |
urn:oid:1.3.6.1.4.1.25178.1.2.9 | schacHomeOrganization |
urn:oid:1.3.6.1.4.1.5923.1.1.1.6 | eduPersonPrincipalName |
urn:oid:1.3.6.1.4.1.5923 |
...
eduPersonScopedAffiliation
...
.1 |
...
.1 |
...
.1. |
...
10 | eduPersonTargetedID |
urn:oid:1.3.6.1.4.1.5923 |
...
.1.1. |
...
1 |
...
. |
...
13 | eduPersonUniqueId |
urn:oid: |
...
2.5.4.3 | cn |
urn:oid:2.5.4.4 | surname |
urn:oid:2.5.4.42 | givenName |
- OIDC Claims and Scopes
| OIDC Claim | Scope |
|---|---|
| subject-id | openid |
| name | profile |
| given_name | profile |
| family_name | profile |
...
| entitlements |
...
| entitlements |
...
eduperson_scoped_affiliation
...
| schac_home_organization | schac_home_organization |