...

For an example on how to consume and process this information in an Identity Provider look at the page Example of a standard attribute filter for Shibboleth IdP v3.4.0 and above. ADFS Toolkit support the use of entity categories.

...

The entity category European Student Identifier is a category to primary support student exchange programs like Erasmus+. This entity category only supports one value in on one specific attribute and expected to be used together with other entity categories, for example Personalized Access.

...

...

Expected attribute release from an Identity Provider

Process for applying for tagging a service with entity category REFEDS Anonymous Access Entity Category

...

Expected attribute release from an Identity Provider

Process for applying for tagging a service with entity category REFEDS Pseudonymous Access Entity Category

...

Expected attribute release from an Identity Provider

Process for applying for tagging a service with entity category REFEDS Personalized Access Entity Category

...

Besides the formal requirements and recommendations of REFEDS Personalized Access Entity Category are Service Providers it is highly recommended that the service also adheres to the REFEDS Security Incident Response Trust Framework for Federated Identity (Sirtfi).

...

REFEDS Research and Scholarship (R&S)

...

Expected attribute release from an Identity Provider

Process for applying for tagging a service with entity category REFEDS Research and Scholarship

For a service to be tagged with REFEDS Research and Scholarship (R&S) it must contact the federation that it has registered with. If the service is registered within the SWAMID federation the service operator sends an e-mail to operations@swamid.se with a formal request that contains the information below. Upon receiving the request SWAMID operations will respond within two weeksupdates the service metadata in the SWAMID Metadata Tool.

The request must besides the metadata update contain the following administrative information:

...

Besides the formal requirements and recommendations of REFEDS R&S it is highly recommended that the service also adheres to the REFEDS Security Incident Response Trust Framework for Federated Identity (Sirtfi).

REFEDS

...

Data Protection Code of Conduct (CoCo v2)

REFEDS Data Protection Code of Conduct entity category is used both within SWAMID and in the eduGAIN interfederation to make services available to users of the higher education institutions in Sweden and around Europe. The entity category makes it possible to automatically release mostly harmless attributes to Service Providers in the spririt of the EU Data Protection legislation. The expected Identity Provider behaviour is to release the Service Provider required attributes if the IdP is able to. Required attributes means attributes the service must have to be able to work for the user. However it's possible to require more than one attribute of a specific type, i.e. name and identifier attributes, to increase the possibility to get the needed set of attributes. The required attributes for a specific service is defined in the the service metadata and must be described in the mandatory Service Provider Privacy Policy. There is furthermore an identity provider entity support category that should be registered for all Identity Provider that supports the REFEDS Data Protection Code of Conduct entity category that can be used for filter purpose in a discovery service.

Expected attribute availability from an Identity Provider for attributes required by indication in metadata

Multivalued attributes that have different values for different services shall not be requested via metadata, examples of such attributes are eduPersonEntitlement, norEduPersonLIN and schacPersonalUniqueCode. The reason for this is that an Identity Provider may unintensional release sensitive information to services that are not eligable for these values. SWAMID recommends member Identity Providers to not release this type of attributes based on reqeusted attributes in metadata.

Process for applying for tagging a service with entity category REFEDS Data Protection Code of Conduct

For a service to be tagged with REFEDS Data Protection Code of Conduct it must contact the federation that it has registered with. If the service is registered within the SWAMID federation the service operator updates the service metadata in the SWAMID Metadata Tool.

The request must besides the metadata update contain the following administrative information:

• Purpose and scope of the service.
• Documentation which proves that the service has fulfilled all the requirements for CoCo and lawfullness of processing as described in GDPR if it's not defined by purpose and scope of the service:
  • the grounds under which the Service Provider supports transfer of data as either:
    • Operating in a country within the European Union or European Economic Area or a country, territory, sector or international Organisation with an adequacy decision pursuant to GDPR Article 45, and
    • Using appropriate safeguards pursuant to GDPR Article 46 and committed to only receiving data from organisations where safeguards have been agreed.
  • that the service has committed to theREFEDS/GÉANT Data Protection Code of Conduct,
  • that it informs the Registrar about any material changes that may influence their ability to commit to the REFEDS/GÉANTData Protection Code of Conduct
• A list of the required attributes that the service needs to function (the list is also required in the privacy policy of the service). It is possible to require more than one attribute of a specific type, i.e. name and identifier attributes, to increase the possibility to get the needed set of attributes.

Unless the following is already published in current service metadata, the metadata update request must contain:

• Well functional SAML2 metadata for the service with an entityid in URL-form as described in the SWAMID SAML WebSSO Technology Profile.
• Display name for the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
• Short description of the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
• A list of required attributes of the Service.
• Administrative contact for the service and it's recommended that technical, support and security contact is also given.
• URL to a publicly accessible web page (not a pdf document) with the service privacy policy in English and preferable also in Swedish, a privacy policy example template: SWAMID Service Provider Privacy Policy Template. The privacy policy must at least contain:
  
  • the name, address and jurisdiction of the Service Provider;
  • the purpose or purposes of the processing of the Attributes;
  • a description of the Attributes being processed;
  • the third party recipients or categories of third party recipient to whom he Attributes might be disclosed, and proposed transfers of Attributes to countries outside of the European Economic Area;
  • the existence of the rights to access, rectify and delete the Attributes held about the End User; and
  • the retention period of the Attributes.

It's also a highly recommended that the service adheres to the REFEDS Security Incident Response Trust Framework for Federated Identity (Sirtfi).

GÉANT Data Protection Code of Conduct (CoCo v1)

CoCo GÉANT Data Protection Code of Conduct entity category is used both within SWAMID and in the eduGAIN interfederation to make services available to users of the higher the higher education institutions in Sweden and around Europe. The CoCo entity category makes it possible to automatically release mostly harmless attributes to Service Providers which fulfil in the spririt of the EU Data Protection legislation. The expected Identity Provider behaviour is to release the Service Provider required release the Service Provider required attributes if the IdP is able to. Required attributes means attributes the service must have to be able to work for the user. However it's possible to require more than one attribute of a specific type, i.e. name and identifier attributes, to increase the possibility to get the needed set of attributes. The required attributes for a specific service is defined in the the service metadata and must be described in the mandatory Service Provider Privacy Policy.  There There is furthermore an identity provider entity support category that should be registered for all Identity Provider that supports the CoCo Provider that supports the GÉANT Data Protection Code of Conduct entity category that can be used for filter purpose in a discovery service.

Expected attribute availability from an Identity Provider for attributes required by indication in metadata

Multivalued attributes that have different values for different services shall not be requested via metadata, examples of such attributes are eduPersonEntitlement, norEduPersonLIN and schacPersonalUniqueCode. The reason for this is that an Identity Provider may unintensional release sensitive information to services that are not eligable for these values. SWAMID recommends member Identity Providers to not release this type of attributes based on reqeusted attributes in metadata.

Process for applying for tagging a service with entity category

...

GÉANT Data Protection Code of Conduct

For a service to be tagged with GÉANT Data Protection Code of Conduct it Conduct it must contact the federation that it has registered with. If the service is registered within the SWAMID federation the service operator sends an e-mail to operations@swamid.se with a formal request that contains the information below. Upon receiving the request SWAMID operations will respond within two weeksupdates the service metadata in the SWAMID Metadata Tool.

The request must besides the metadata update contain the following administrative information:

• Purpose and scope of the service.
• Documentation which proves that the service has fulfilled all the requirements for CoCo and lawfullness of processing as described in GDPR if it's not defined by purpose and scope of the service:
  • the grounds under which the Service Provider supports transfer of data as either:
    • Operating in a country within the European Union or European Economic Area or a country, territory, sector or international Organisation with an adequacy decision pursuant to GDPR Article 45, and
    • Using appropriate safeguards pursuant to GDPR Article 46 and committed to only receiving data from organisations where safeguards have been agreed.
  • that the service has committed to theREFEDS/GÉANT Data Protection Code of Conduct,
  • that it informs the Registrar about any material changes that may influence their ability to commit to the REFEDS/GÉANTData Protection Code of Conduct
• A list of the required attributes that the service needs to function (the list is also required in the privacy policy of the service). It is possible to require more than one attribute of a specific type, i.e. name and identifier attributes, to increase the possibility to get the needed set of attributes.

...

• Well functional SAML2 metadata for the service with an entityid in URL-form as described in the SWAMID SAML WebSSO Technology Profile.
• Display name for the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
• Short description of the Service in English and preferable also in Swedish for use in Identity Providers' login pages and Discovery Services.
• A list of required attributes of the Service.
• Administrative contact for the service and it's recommended that technical, support and security contact is also given.
• URL to a publicly accessible web page (not a pdf document) with the service privacy policy in English and preferable also in Swedish, a privacy policy example template: SWAMID Service Provider Privacy Policy Template. The privacy policy must at least contain:
  
  • the name, address and jurisdiction of the Service Provider;
  • the purpose or purposes of the processing of the Attributes;
  • a description of the Attributes being processed;
  • the third party recipients or categories of third party recipient to whom he Attributes might be disclosed, and proposed transfers of Attributes to countries outside of the European Economic Area;
  • the existence of the rights to access, rectify and delete the Attributes held about the End User;
  • the retention period of the Attributes; and
  • a reference to this Code of Conduct including the formal reference URL http://www.geant.net/uri/dataprotection-code-of-conduct/v1.

...

Expected attribute release from an Identity Provider

Process for applying for tagging a service with entity category European Student Identifier Entity Category

...