...
For an example on how to consume and process this information in an Identity Provider look at the page Example of a standard attribute filter for Shibboleth IdP v3.4.0 and above. ADFS Toolkit support the use of entity categories.
REFEDS Anonymous Access Entity Category
entity-category URI | |
|---|---|
| eduGAIN enabled | Yes |
| Info | ||
|---|---|---|
| ||
Candidates for the Anonymous Access Entity Category are Service Providers that offer a level of service based on proof of successful authentication. None of the attributes in this entity category are specifically intended to provide authorization information. By asserting this entity category, Service Providers are signaling that they do not wish to receive personalized data. Please note that the first of the REFEDS Anonymous Access Entity Category, then called REFEDS Anonymous Authorization Entity Category, was published early 2021 and therefore not so many Identity Providers has support for it yet. SWAMID recommends that you complement the REFEDS Anonymous Access Entity Category with the entity category GÉANT Data Protection Code of Conduct until end of 2024 to get the expected attribute release. |
The Anonymous Access Entity Category is used both within SWAMID and in the eduGAIN interfederation to make services available to users of the higher education institutions in Sweden and around the world. The entity category makes it possible to automatically release a set of mostly harmless attributes to Service Providers registered in the academic federations.
The expected Identity Provider behaviour is to release to the Service Provider a predefined set of attributes. Service Providers signals their need of Anonymous Access Entity Category via an entity category tag in metadata. There is furthermore an identity provider entity support category that should be registered for all Identity Providers that supports the Anonymous Access Entity Category.
Expected attribute release from an Identity Provider
| Attribute(s) | SAML2 Attribute Identifier | Comment |
|---|---|---|
| eduPersonScopedAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.9 | |
| schacHomeOrganization | urn:oid:1.3.6.1.4.1.25178.1.2.9 |
Process for applying for tagging a service with entity category REFEDS Anonymous Access Entity Category
For a service to be tagged with REFEDS Anonymous Access Entity Category it must contact the federation that it has registered with. If the service is registered within the SWAMID federation the service operator updates the service metadata in the SWAMID Metadata Tool.
The request must besides the metadata update contain the following administrative information:
- Purpose and scope of the service.
The entity category has the following metadata requirements:
- Well functional SAML2 metadata for the service with an entityid in URL-form as described in the SWAMID SAML WebSSO Technology Profile.
- Display name for the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
- URL to an informational web page that describes the service in English and preferable also in Swedish.
- At least one of the administrative, technical and support contact for the service and it's recommended that security contact is also given.
The request is highly recommended to also have the following information for metadata publication:
- URL beginning with https to the service logotype for use in Identity Providers login pages and Discovery Services.
Besides the formal requirements and recommendations of REFEDS Anonymous Access Entity Category are Service Providers it is highly recommended that the service also adheres to the REFEDS Security Incident Response Trust Framework for Federated Identity (Sirtfi).
REFEDS Pseudonymous Access Entity Category
...
| Info | ||
|---|---|---|
| ||
Candidates for the Pseudonymous Access Entity Category are Service Providers that offer a level of service based on proof of successful authentication and offer personalization based on a pseudonymous user identifier. The Service Provider must be able to effectively demonstrate this need to their federation registrar (normally the Service Provider’s home federation) and demonstrate their compliance with regulatory requirements concerning personal data through a published Privacy Notice. None of the attributes in this entity category are specifically intended to provide authorization information. |
...
For REFEDS Pseudonymous Access Entity Category there is a formal requirement that the service shall publish a public Privacy Policy. SWAMID have published a Service Provider Privacy Policy Template for GÉANT Data Protection Code of Conduct that can be used except for the requirement for mention the GÉANT Data Protection Code of Conduct.
Expected attribute release from an Identity Provider
| Attribute(s) | SAML2 Attribute Identifier | Comment |
|---|---|---|
| pairwise-id | urn:oasis:names:tc:SAML:attribute:pairwise-id | |
| eduPersonAssurance | urn:oid:1.3.6.1.4.1.5923.1.1.1.11 | |
| eduPersonScopedAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.9 | |
| schacHomeOrganization | urn:oid:1.3.6.1.4.1.25178.1.2.9 |
...
- Purpose and scope of the service.
- Documentation which proves that the service has fulfilled all the requirements for REFEDS Personalized Access for REFEDS Pseudonymous Access Entity Category if it isn't defined by purpose and scope of the service.
- The service has a proven and documented need for the pseudonymous information that forms the attribute bundle for this entity category.
- The Service Provider has committed to data minimisation and will not use the attributes for purposes other than as described in their application.
...
- Well functional SAML2 metadata for the service with an entityid in URL-form as described in the SWAMID SAML WebSSO Technology Profile.
- Display name for the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
- URL to an informational web page that describes the service in English and preferable also in Swedish.
- URL to a web page with the service privacy policy in English and preferable also in Swedish, a privacy policy example template: SWAMID Service Provider Privacy Policy Template.
- At least one of the administrative, technical and technical support contact for the service and it's recommended that support and security contact is also given.
...
For REFEDS Personalized Access Entity Category there is a formal requirement that the service shall publish a public Privacy Policy. SWAMID have published a Service Provider Privacy Policy Template for GÉANT Data Protection Code of Conduct that can be used except for the requirement for mention the GÉANT Data Protection Code of Conduct.
Expected attribute release from an Identity Provider
| Attribute(s) | SAML2 Attribute Identifier | Comment |
|---|---|---|
| subject-id | urn:oasis:names:tc:SAML:attribute:subject-id | |
| urn:oid:0.9.2342.19200300.100.1.3 | Can be more than one address released but Identity Providers are recommended to release only one. | |
| displayName | urn:oid:2.16.840.1.113730.3.1.241 | |
| givenName | urn:oid:2.5.4.42 | |
| sn | urn:oid:2.5.4.4 | |
| eduPersonAssurance | urn:oid:1.3.6.1.4.1.5923.1.1.1.11 | |
| eduPersonScopedAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.9 | |
| schacHomeOrganization | urn:oid:1.3.6.1.4.1.25178.1.2.9 |
...
- Well functional SAML2 metadata for the service with an entityid in URL-form as described in the SWAMID SAML WebSSO Technology Profile.
- Display name for the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
- URL to an informational web page that describes the service in English and preferable also in Swedish.
- URL to a web page with the service privacy policy in English and preferable also in Swedish, a privacy policy example template: SWAMID Service Provider Privacy Policy Template.
- At least one of the administrative, technical and technical support contact for the service and it's recommended that support and security contact is also given.
The request is highly recommended to also have the following information for metadata publication:
...
For REFEDS Research and Scholarship there is no formal requirement that the service shall publish a public Privacy Policy. However all services that are registered in SWAMID must have a Privacy Policy to inform end users about how personal data are processed. SWAMID have published a Service Provider Privacy Policy Template for GÉANT Data Protection Code of Conduct that can be used except for mention the GÉANT Data Protection Code of Conduct.
Expected attribute release from an Identity Provider
| Attribute(s) | SAML2 Attribute Identifier | Comment |
|---|---|---|
| eduPersonTargetedID | urn:oid:1.3.6.1.4.1.5923.1.1.1.10 | Should only be released by the Identity Provider if eduPersonPrincipalName is re-assignable to another user. |
| eduPersonPrincipalName | urn:oid:1.3.6.1.4.1.5923.1.1.1.6 | |
| urn:oid:0.9.2342.19200300.100.1.3 | Can be more than one address released but Identity Providers are recommended to release only one. | |
| displayName and/or givenName and sn | urn:oid:2.16.840.1.113730.3.1.241 | A user's name can be released in different ways and it's expected that the Service Provider can handle this. |
| eduPersonAssurance | urn:oid:1.3.6.1.4.1.5923.1.1.1.11 | Local addon within SWAMID. Services shall only expect this attribute to be available from Identity Providers within SWAMID. |
| eduPersonScopedAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.9 |
...