Overview of schemas used for IdM community Setting up of identity provider Motonori Nakamura, National Institute of Informatics, Japan 2nd TEIN IAM Workshop in Kuala Lumpur 1

2 SP IdP (Identity Provider) DS (Discovery Service) SP (Service Provider) SP (Service Provider) SAML (Attribute)

3 Name (abbreviation)Description OrganizationName (o) English name of the organization jaOrganizationName (jao)Japanese name of the organization OrganizationalUnit (ou)English name of a unit in the organization jaOrganizationalUnit (jaou)Japanese name of a unit in the organization eduPersonPrincipalName (eppn)Uniquely identifies an entity in GakuNin eduPersonTargetedIDA pseudonym of an entity in GakuNin eduPersonAffiliationStaff, Faculty, Student, Member eduPersonScopedAffiliationStaff, Faculty, Student, Member with scope eduPersonEntitlementQualification to use a specific application SurName (sn)Surname in English jaSurName (jasn)Surname in Japanese givenNameGiven name in English jaGivenNameGiven name in Japanese displayNameDisplayed name in English jaDisplayNameDisplayed name in Japanese mail address gakuninScopedPersonalUniqueCodeStudent or faculty, staff number with scope Attributes managed by an IdP Released attributes are different among SPs SP-A (2 attr.s required) eppn (mandatory) eduPersonAffiliation (optional) SP-B (1 attr. required) eduPersonAffiliation (mandatory) SP-C (2 attr.s required) eduPersonTargetedID (mandatory) eduPersonEntitlement eduPersonScopedAffiliation (one of them is mandatory)

4  Anonymous  Any identifier is not sent  Fit for e-Journals (a member (of a department) of the organization can access)  Autonymous  eduPersonPrincipalName is sent  Unique identifier shared by all SPs (globally unique)  Similar to address  Pseudonymous  eduPersonTargetedID is sent [hash(ePPN, entityID of SP)]  Persistent unique identifier to each SP  To avoid correlation of user activities among SPs

5 Name (abbreviation)Description OrganizationName (o) English name of the organization jaOrganizationName (jao)Japanese name of the organization OrganizationalUnit (ou)English name of a unit in the organization jaOrganizationalUnit (jaou)Japanese name of a unit in the organization eduPersonPrincipalName (eppn)Uniquely identifies an entity in GakuNin eduPersonTargetedIDA pseudonym of an entity in GakuNin eduPersonAffiliationStaff, Faculty, Student, Member eduPersonScopedAffiliationStaff, Faculty, Student, Member with scope eduPersonEntitlementQualification to use a specific application SurName (sn)Surname in English jaSurName (jasn)Surname in Japanese givenNameGiven name in English jaGivenNameGiven name in Japanese displayNameDisplayed name in English jaDisplayNameDisplayed name in Japanese mail address gakuninScopedPersonalUniqueCodeStudent or faculty, staff number with scope Not much used Static Not much used Generated from ID From LDAP tree Not so difficult to map the Shib Attr and LDAP Not so difficult to map the Shib Attr and LDAP urn:mace:dir:entitlement:common-lib-terms

 6

 ments/AttributeUsage ments/AttributeUsage 7

8  To send out requested attributes  There are other related topics  Attribute release user consent mechanism (uApprove)   ?pageId= (uApproveJP) ?pageId=  Shibboleth 3.0 will have user consent feature.  Automatic attribute-filter generation cooperated with GakuNin Registration System  ?pageId= (In Japanese only, sorry) ?pageId=

9

 Users can choose optional attributes to be released.  Users can also select future action. Mandatory attributes Optional attributes Agree to release for all SPs in the future Agree to release for this SP in the future Need to confirmation again for next access even to the same SP √ √ √