Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Table of Contents

...

UH Identity Provider Service Values for Service Providers

Service Providers require the following information so that their SP is able to interface successfully with the UH Identity Provider service.

IdP Info

UH Value

Notes

Identity Provider EntityID

https://idp.hawaii.edu/idp/shibboleth

Production Environment (and metadata source URL)

Identity Provider EntityID

https://idp-test.its.hawaii.edu/idp/shibboleth

Test Environment (and metadata source URL)

Administrator Email Address

its-iam-help@lists.hawaii.edu


(info) UH is considered to be an Identity Provider.

...

Service Provider Test Environments Recommended

It is recommended that a test environment for the service provider be available to test candidate configurations in our UH identity provider test environment to ensure everything meets expectations before deployment to our production environment. If unable to test candidate configurations in our test environment first, we are capable of deploying candidates directly to our production environment, but change management procedures constrain this and limits how quickly we can test and deploy any necessary changes.

It is also highly recommended that a service provider test environment be generally available beyond the initial service deployment. When the Shibboleth IdP is upgraded as necessary, An SP test environment will provide a means to test against any new integration changes before the new versions are deployed to our production Identity Provider environment.

Released Attributes

The attributes are released as specified by the attribute release policy set up for each SP. Below is a subset of the available attributes. UH generally uses the eduPerson schema.

...

Attribute

Description

Example Data

Additional Info

cn

Common Name

Jane Doe


sn

Surname

Doe


givenName

Given name

Jane


displayName

Preferred form of name for display

J. Doe

  • Optional, may often not be present

eduPersonAffiliation

Campus affiliation

student


eduPersonScopedAffiliation

Campus affiliation @ scope (hawaii.edu)

student@hawaii.edu


eduPersonPrincipalName (ePPN)

UH Username '@' scope (hawaii.edu)

jdoe@hawaii.edu

  • These are never reassigned

eduPersonTargetedID (ePTID)

An opaque, persistent unique id for each person for each Service Provider.

yWuV78oU5z65ulepbaOCsrjHMtI=

  • This attribute is designed to help preserve user privacy by preventing different Service Providers from aggregating and matching user data

  • Recent Internet2 MACE-dir discussions suggest that this attribute may be deprecated in the future. eduPersonUniqueID is the heir apparent.

  • A cryptographically secure hash is utilized to create the unique identifier for each user for each Service Provider

  • (warning) This attribute is deprecated

uhEmail

Email address

jdoe@hawaii.edu

  • Single valued

  • These are never reassigned

uhUuid

UH Number

12341234

  • AKA Employee Id and Student Id

  • These are never reassigned

uid

UH Username

jdoe

  • These are never reassigned

uhOrgAffiliation

Organizational affiliations by role

eduPersonOrgDn=kauaicc,eduPersonAffiliation=faculty

  • May be multi-valued unordered set, returned order is not significant

principal

Name used to AuthN to the IdP

jdoe

  • Used for Google @ UH

...