<html><head><base href="x-msg://108/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Andi,</div><div><br></div>I shouldn't have begun my answer with a flat "No." As I said, it is possible to change the eduPerson spec, if the rationale is there and it finds support in the community. But all things considered, local solutions are usually more appropriate and surely quicker.<div><br></div><div> Regards, --Keith<div>_________________<br><div><div>On Oct 25, 2012, at 10:52 AM, Morris, Andi wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-GB" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks Keith, that’s very helpful. I’ll look further into defining local attributes for this specific purpose, as that sounds like the ideal solution.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Cheers,<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Andi<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0cm; padding-bottom: 0cm; padding-left: 0cm; "><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:users-bounces@shibboleth.net" style="color: blue; text-decoration: underline; ">users-bounces@shibboleth.net</a><span class="Apple-converted-space"> </span>[mailto:users-bounces@shibboleth.net]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Keith Hazelton<br><b>Sent:</b><span class="Apple-converted-space"> </span>25 October 2012 16:46<br><b>To:</b><span class="Apple-converted-space"> </span>Shib Users<br><b>Cc:</b><span class="Apple-converted-space"> </span>mace-dir<br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: edupersonAffiliation attribute fields<o:p></o:p></span></div></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">On Oct 25, 2012, at 10:32 AM, Morris, Andi wrote:<o:p></o:p></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><br><br><o:p></o:p></div><div><div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">Hi all,<o:p></o:p></span></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">Just a quick one and hopefully an easy one for the more experienced Shibboleth admins than myself. Currently we assign edupersonaffiliation attributes dependent on AD Organisational Unit name, but I’ve been requested to split these users up further to separate affiliate members, and UK Affiliate members to allow differing access to resources.<o:p></o:p></span></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">I could just tag one of them ‘employee’ or similar, but I don’t want to start assigning these fields to arbitrarily in case we start using Shibboleth more extensively in the future and require these attributes to be used elsewhere.<o:p></o:p></span></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">Is there scope for adding more edupersonaffiliation attributes than the standard?<o:p></o:p></span></div></div><ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm; "><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">member</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">student</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">employee</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">faculty</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">staff</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">alum</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li><li class="MsoNormal" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; line-height: 13.5pt; background-color: white; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; z-index: auto; background-position: initial initial; background-repeat: initial initial; "><span style="font-size: 9pt; font-family: Verdana, sans-serif; ">affiliate</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></li></ul></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">No. This list is defined in the eduPerson specification as being the only legal values for eduPerson(Scoped)Affiliation.<o:p></o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">If you need another value, the suggestion would be do define a local attribute and put whatever values you want in there. Then you need to communicate to your SPs where to look for those new values. <o:p></o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">Many campuses have done this. If you are using LDAP, this would involve creating an object class and a set of new attributes with a prefix modeled on your institutional domain name. So, for example, wiscEduPersonFoo, wiscEduPersonBar, etc. For SAML purposes, those attributes need to be identified by an OID.<o:p></o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; ">The eduPerson list is not set in concrete. If you believe there is a value missing from the list that would have wide inter-institutional use and adoption, please let me know. I would share it with the MACE-Dir group for consideration. It is not a quick solution, though.<o:p></o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "> --Keith Hazelton<o:p></o:p></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><br><br><o:p></o:p></div><div><div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">Cheers,<o:p></o:p></span></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; ">Andi<o:p></o:p></span></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 10pt; font-family: Arial, sans-serif; ">---------------------------------------------------------------<br>Andi Morris<br>Technical Security Analyst</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 10pt; font-family: Arial, sans-serif; ">Systems and Communications Services<br>Information Services Division<br>Cardiff Metropolitan University<br>Cardiff<br>Wales<br>CF5 2YB</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 10pt; font-family: Arial, sans-serif; "> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 10pt; font-family: Arial, sans-serif; ">02920 205720</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></div></div><div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 10pt; font-family: Arial, sans-serif; ">--------------------------------------------------------------</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; "><o:p></o:p></span></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; "> <o:p></o:p></span></div></div><div class="MsoNormal" align="center" style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; text-align: center; "><span style="font-size: 13.5pt; font-family: Helvetica, sans-serif; "><hr size="2" width="100%" align="center"></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 13.5pt; font-family: Helvetica, sans-serif; "><br>>From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address.<span class="apple-converted-space"> </span><b>Please could you ensure that all of your contact records and databases are updated to reflect this change.</b><span class="apple-converted-space"> </span>Further information can be found on the website<span class="apple-converted-space"> </span><a href="http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx" style="color: blue; text-decoration: underline; ">here.</a><span class="apple-converted-space"> </span><br><br>Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o‘r cyfeiriad @cardiffmet.ac.uk newydd.<span class="apple-converted-space"> </span><b>Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn.</b><span class="apple-converted-space"> </span>Gellir cael rhagor o wybodaeth ar y wefan<span class="apple-converted-space"> </span><a href="http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx" style="color: blue; text-decoration: underline; ">yma.</a><span class="apple-converted-space"> </span><br><br>--<br>To unsubscribe from this list send an email to<span class="apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: blue; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a><o:p></o:p></span></div></div></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div></div>--<br>To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: blue; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a><br></div></span></blockquote></div><br></div></div></body></html>