...
Attribute Requirements
From the SAML-message, http://rnd.feide.no/simplesamlphp simpleSAMLphp returns the attributes in an associative array. Since the different federations implement some of the various attributes slightly differently, and not all attributes are mandatory, we cannot rely on a single namespace for this. So, to combat this, we have added a way for the NREN Administrator to assign the provided attributes to the required Confusa attributes. The required attributes are also listed, with a short description about intended usage and the consequence when it is unavailable.
...
The organization is used to find the proper maps, administrators etc. It is also added to the \DN of the certificate. The most sensible attributes to use here are eduPersonOrgDN(ePODN)
or http://rnd.feide.no/content/schachomeorganization schacHomeOrganization. Which attribute is to be used can be configured on the NREN-level and only on the NREN-level. If this attribute could be configured on the subscriber-level as well, it would be impossible for Confusa to infer to which NREN a subscriber-admin belongs. If no attribute is set, Confusa cannot sign certificates.
...
The CP/CPS requires us to notify the user about a newly issued certificate through other channels than the currently active (the web interface). We therefore need the email-address to ship a receipt to. The attribute that is used for this can be configured on NREN and subscriber level by the respective admins. A reasonable attribute is http://rnd.feide.no/attribute/mail mail. If no attribute is set, Confusa cannot sign certificates for the user.
...
The entitlement is the IdP's way of notifying Confusa that the given user is entitled to certain actions. This is not a required attribute for other users than the administrators. I.e. the IdP can easily remove an administrator. However, we do not want the IdPs to wildly add new administrator, so this attribute is a necessary but not sufficient condition for getting administrator privileges.
If not set, the user cannot be administrator. The attribute is freely configurable on the NREN-level. we have disabled it on the subscriber-level to avoid having subscriber-admins lock themselves and their whole institution out of the portal. However, we recommend usage of the eduPersonEntitlement attribute.
| Panel |
|---|
TCS-\[eScience\|Personal\]-PortalThe central TCS eScience portal currently uses the following entitlement attributes:
|
...
| ePPN | ePODN | mail | Full Name | entitlement | enforced |
|---|---|---|---|---|---|---|
Log in | required | optional | optional | optional | optional | yes |
Admin | required | required | optional | optional | required | yes |
Create certificate | required | required | required | required | required | yes |
Revoke certificate (user) | required | optional | optional | optional | optional | yes |
E-Mail certificate | required | optional | required | optional | optional | yes |
The 3 different Attribute Mapping cases
- The subscriber is not yet configured (an attribute map has not been created)
The user will be shown a message on the form "Your NREN has not yet configured the attribute mapping for your organization. - The NREN has created a default-mapping but not a dedicate subscriber mapping
Confusa will try to use the default NREN-mapping for the attributes. In most settings, this will be the appropriate action. - A subscriber-admin has created a dedicated attribute-map for the subscriber
This is given the highest precedence. Confusa will first look for this map. If not found, it will look for the default NREN-map. And finally, if the NREN-map is not found, it will display an error to the user.
The attribute mapping process (NREN)
System Requirements
We try to write distro independent code. However, subtle changes between the GNU/Linux distributions may lead to the occasional bug. Confusa is tested and should work flawlessly on the following distributions:
...