InCommon eduGain and release policies

[Jeffrey Crawford]

Jeffrey E. Crawford
ITS Application Administrator (IdM)
831-459-4365
jeffreyc at ucsc.edu

Both pilots and IT professionals require training and currency before
charging into clouds!
---------------------------------------

On Fri, Jan 29, 2016 at 1:20 PM, Tom Scavo <trscavo at gmail.com> wrote:

> On Fri, Jan 29, 2016 at 4:04 PM, Jeffrey Crawford <jeffreyc at ucsc.edu>
> wrote:
> >
> > On Fri, Jan 29, 2016 at 12:35 PM, Tom Scavo <trscavo at gmail.com> wrote:
> >>
> >> More generally, SAML2 Persistent NameID should be just fine. It can be
> >> difficult to deploy but if you already have it deployed, by all means
> >> use it. It has the best privacy preserving properties of any
> >> well-known identifier.
> >
> > other than the fact some eduGain entities specifically have transient
> listed
> > first but I think they request attributes as well but I only spot
> checked.
>
> The only way we'll truly ever be able to rely on requested attributes
> in metadata is by using meta-attributes:
> https://spaces.internet2.edu/x/QgOVBQ

​We do have filter configs that will honor ​requests, since the user has to
consent anyway, but transient vs persistent is set in the relying party
preference pragma, or it's read from the NameIDFormat order in the
metadata. In either case the user doesn't by default get shown either
transient or persistent on the consent page. As of today they would only
see that eduPersonScopedAffiliation is sent.

>
>
> > Does REFEDS R&S have more attributes than InCommon does? I'm sure it's
> > documented somewhere but I didn't find it quickly.
>
> No, the attribute requirements are exactly the same.
>
​Fair enough but has someone somewhere come up with a list of attributes
that could be useful for the ones that request outside of R&S. The user
still has to consent to the release in our case so we may want to consider
them.

>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160129/49a773b5/attachment.html>