Page History

The services requires to uniquely identify users for authorization purposes. Without some a unique identifier, it is impossible to distinguish two different users between each other.

As a service that supports Sirtfi, it is required that it is able to uniquely identify users.

pairwise-id

eduPersonPrincipalName1

eduPersonTargetedID

eduPersonUniqueId

Access to the resources connected through MyAccessID will be dominantly supported by identites coming from the IdPs from the R&E sector and eduGAIN.

Best-fit and natural is to use the Assurance Framework that originated as collaborative work of R&E federations - the REFEDS Assurance suite https://wiki.refeds.org/display/ASS.

To insure identifier uniqueness:

• https://refeds.org/assurance/ID/UNIQUE; or
• https://refeds.org/assurance/ID/eppn-unique-no-reassign

To insure sufficient identity proofing and credential issuance, renewal, and replacement:

• https://refeds.org/assurance/IAP/medium; or
• https://refeds.org/assurance/IAP/high

See Level of Assurance Requirements for more information.

 ⚠️  Level of Assurance information is planned to become mandatory in 2022

cn

MyAccessID and the services connected through MyAccessID expect to receive the name of the user.

For example, when a user applies for a new project or for membership membership to an existing project, the managers need to be able to recognise who the applicant is.

sn + givenName

mail

MyAccessID needs to be able to contact the user regarding the status of their account. In addition, many of the services connected through MyAccessID expect the email of the user in order to be able contact the user about service related matters.

eduPersonScopedAffiliation

Access to many of the resources connected through MyAccessID relies on authorising users based on the affiliation of their members with their home organisation.

Access to many of the service connected through MyAccessID relies on authorising users based on their home organisation.