member vs institute level

[Andy Bennett]

Hi,

> We are part of the the UK Federation and so the explanation does not
> seem to make much sense? If it also does not make much sense to anybody
> else then I will go back to the publisher and take umbrage with them.

It doesn't make much sense to me either but here's some information
about the two types of affiliation assertion and how I handle them.

Are you able to give an example of the attributes that you are releasing
to them?

I'm part of the UK federation as well (as a Service Provider) and IdPs
tend to send me {member,student,staff,...}@security-domain for
scoped-affiliation. Some send an unscoped-affiliation as well but most
do not so we tend to ignore this attribute.

What do you send for security-domain?

>From reading the specs:

http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonAffiliation

http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonScopedAffiliation

http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200312.html

...both attributes have the controlled vocab of
{faculty,student,staff,alum,member,affiliate,employee,library-walk-in}
but the scoped affiliation is allowed to contain a security domain as well.

"The right component identifies the security domain in the form of a
dotted string value on the model of DNS domain names. This right-hand
side syntax of eduPersonScopedAffiliation intentionally matches that
used for the right-hand side values for eduPersonPrincipalName since
both identify a security domain."

It is noted:
"Consumers of eduPersonScopedAffiliation will have to decide whether or
not they trust values of this attribute. In the general case, the
directory carrying the eduPersonScopedAffiliation is not the ultimate
authoritative speaker for the truth of the assertion. Trust must be
established out of band with respect to exchanges of this attribute value."


Most UK universities seem to be direct members of the UK Federation.
Some UK schools (in the UK sense of the word) are indirect members of
the federation in that the membership is held by the county council that
provides their IT services. I'm not sure how this affect the security
domain that is sent in a scoped affiliation.





Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/