Child pages
  • Mapping SAML attributes to OIDC Claims
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Current »

Introduction

This pages show compatible (or not) mappings between OIDC claims and eduPerson SAML attributes. Several claims have direct matches, for some claims/attributes an attribute is available, but an implementation choice must be made.

OIDC schema <-> SAML eduPerson mapping

GREEN = Good Match, YELLOW = Matchable, RED = Problems

 

  Strong matchWeak matchRemark
OIDC    
OICD ScopeOICD nameeduPerson name  
profilesub 

eduPersonPrincipalName

eduPersonTargetedID/NameID

eduPersonUniqueId

See 'Identifier' Claims mapping tab
 name cn displayNameMulti value issues?
 given_namegivenName  
 family_namesn (surname)  
 middle_name   
 nicknameeduPersonNickname EduPersonNickname not really used (?)
 preferred_usernamedisplayName  
 profilelabeledURIdescriptionlabeledURI not really used (?)
 picturejpegPhoto jpegPhoto not really used (?)
 website   
 gender   
 birthdate  optionally: schacYearOfBirth, schacDateOfBirth, but are these used?
 zoneinfol (localityName) l (localityName) not really used (?)
 localepreferredLanguage  
 address   
 updated_at  Use SAML session info here? LDAP modify timestamp?
email    
 emailmail  
 email_verified  Can we assume an institution email with the domainname of the institution is verified?
address    
 addresspostalAddressstreet 
  postalCode  
  postOfficeBox  
phone    
 phone_numbermobile, telephoneNumberhomePhone 
 phone_number_verified  

Can assume an institution phone nr provided by the IdP is verified?

How would you know this is the IdP?

Orphaned SAML attributes

Several commonly used eduPerson attributes cannot be mapped at all. It is assumed this is not an issue for most, with the exception of the ones marked below.

eduPersonAffiliationregister at https://www.iana.org/assignments/jwt ?
eduPersonScopedAffiliation 
eduPersonEntitlement 
eduPersonOrgDN 
eduPersonOrgUnitDN 
eduPersonPrimaryAffiliationsingle valued variant on affiliation
eduPersonPrimaryOrgUnitDN 
eduPersonPrincipalNamePrior 
eduPersonAssuranceused? compare with AuthnContext
facsimileTelephoneNumber 
homePhone 
homePostalAddress 
initials 
l (localityName) 
manager 
o (organizationName)used locally
ou (organizationalUnitName) 
pager 
seeAlso 
st 
titlelimited use
uid 
uniqueIdentifier 
userCertificate 
userPassword 
userSMIMECertificate 
x500uniqueIdentifier 
  
IsMemberOfwide use in internal campus federations
eduPersonOrcid 
  • No labels