Versions Compared

Old Version 38

changes.mady.by.user trscavo@internet2.edu

Saved on

compared with

New Version 39

changes.mady.by.user Scott Cantor (osu.edu)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Documented Attribute Release Process
  • IdPs SHOULD support the urn:oasis:names:tc:SAML:2.0:nameid-format:persistent name identifier format and/or the eduPersonTargetedID attribute
    • stored or computed? (there are disadvantages with each approach)
  • IdPs SHOULD support the urn:oasis:names:tc:SAML:2.0:nameid-format:transient encrypted name identifier format (requires Shib IdP 2.3)
    • since this identifier can be reversed, it is especially useful for security incident response
  • Release of attributes w/o admin involvement (via consent or otherwise)
    • Strawman: It is RECOMMENDED that eduPersonScopedAffiliation, eduPersonEntitlement, and eduPersonTargetedID be released across the board, to all SPs. The five (5) remaining attributes listed on the InCommon Federation Attribute Summary page SHOULD be released to all SPs provided user consent is obtained. In both cases, we're referring to all SPs in the InCommon Federation.

...