Configuring IdP server

[Robert Bradley]

On 06/05/2021 05:48, Francis Jayakanth via users wrote:
> 
> Hi, In April 2020, our library set up a shibboleth IdP server to 
> facilitate federated access to subscribed online resources. Since then, 
> the IdP server is serving the purpose very well.
> 
> Of late, some of our users want to use federated login to access sites 
> like the CILogon, https://www.cilogon.org/home 
> <https://www.cilogon.org/home> but cannot do so because our IdP server 
> is not releasing the attributes expected by the site. Please see the 
> enclosed screenshot for your reference.
> 
> Our IdP is releasing only three attributes to all the publishers to 
> access the online resources - eduPersonEntitlement, 
> EduPersonScopedAffiliation, and eduPersonTargetedID, and they are 
> adequate to access the publishers' online resources.
> 
> If ​you have configured your IdP server to facilitate federated login to 
> sites like CILogon, NIH,  can you please share the configuration details?
> 

For CILogon to work, you'll need to update your published metadata to 
assert Sirtfi and R&S compliance:

https://refeds.org/sirtfi
https://refeds.org/research-and-scholarship

and then implement the R&S attribute release policy configuration in:

https://wiki.refeds.org/display/ENT/Research+and+Scholarship+IdP+Config

Before doing that, you'll want to read all of those links to find out 
the full details of what you're asserting, and then find out whether 
your organisation can/will agree to implement it.

For NIH, you can (if I recall correctly) get away with manually 
releasing the R&S attribute set (eduPersonPrincipalName, displayName, 
givenName, sn, mail, eduPersonScopedAffiliation) without implementing 
the R&S specification and metadata announcements.  Again, this assumes 
that your organisation is happy to release the attributes in accordance 
with its own policies.

-- 
Dr Robert Bradley
Identity and Access Management Team, IT Services, University of Oxford

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20210507/39ad9d97/attachment.sig>