member vs institute level

[Keith Carr]

On 05/10/12 18:19, Cantor, Scott wrote:
> On 10/5/12 12:03 PM, "Keith Carr" <kecarr at sgul.ac.uk> wrote:
>
>> I have been told by the technical staff at an SP that the reason they
>> are having trouble authenticating our users is that our IdP provides
>> eduPerson attributes are at the "member" level while their SP checks
>> attributes at the "institute" level.
>>
>> Can somebody explain what the difference is or point me to an article
>> which explains the difference?
> That's not terminology that is particularly familiar to the software. The
> only thing that comes to mind is using eduPersonScopedAffiliation values
> that look like member at dept.univ.edu instead of member at univ.edu?
>
> -- Scott
That's what occurred to me also - I have never heard these terms.

The explanation that I was further given (not much of an explanation) was:-

" NPG has an agreement with the UK Federation, and has a list of all
members - meaning that as a provider, we trust all members.
Our software is set up to recognise a user's attributes on an
institutional level ie. 'does the user belong to an institute which is
part of the Federation?'
SGUL's attributes are set at a level below this - so we need to change
our system to check for attributes on a member (of an institution) level
ie. 'is the user a member of X University?' And then 'is X university
part of the UK Federation'?"


We are part of the the UK Federation and so the explanation does not
seem to make much sense? If it also does not make much sense to anybody
else then I will go back to the publisher and take umbrage with them.

Thanks, Keith
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121008/58480df6/attachment.html