About eduPerson attributes

Not generally used in the OpenAthens federation.

The role part of 'scopedAffiliation' of the user.

eduPersonAffiliation

Not generally used in the OpenAthens federation.

A persons nickname or preferred form of address.

eduPersonNickname

Not used in the OpenAthens federation. Little reason to use in any federation.

The DN of the directory entry of the user's organisation.

eduPersonOrgDN

Not used in the OpenAthens federation. Little reason to use in any federation.

The DN of the directory entry of the user's organisation unit.

eduPersonOrgUnitDN

Not generally used in the OpenAthens federation.

A version of eduPersonAffiliation limited to a single value.

eduPersonPrimaryAffiliation

Occasionally used in the OpenAthens federation.

The UPN of the user. Resembles an Email, but is unlikely to be an actual email.

If you release this, OpenAthens will add your scope, so make sure you only populate the 'string' part of this (before the @).

eduPersonPrincipalName

The 'Entitlement' value for a user. This one is technically in common usage, but few service providers ask for it.

Is used to do more granular groupings than roles - e.g. if a library service could not afford to buy access for all 20,000 students, but could for the 150 Geology staff and students, they might arrange with the publisher to pass an entitlement value for just the geologists.

Set these on permission sets.

geology

eduPersonEntitlement

Not used in the OpenAthens federation. Little reason to use in any federation.

Essentially the same as eduPersonOrgUnitDN and just as useful.

eduPersonPrimaryOrgUnitDN

The 'scopedAffiliation' of the user. A two part identifier consisting of a role and a federation_scope.

Since most federations are academic, roles are typically one or more of: member, staff, student, faculty, alum, library-walk-in, affiliate, employee.

The federation scope is the organisation identifier and can identify sub-organisations too - e.g. a group of hospitals might have a root federation scope of eng.nhs.uk, but an individual hospital might have the scope of holbycity.eng.nhs.uk. This facilitates activities such as selling access to the whole group by authorising on *.eng.nhs.uk, or supplying specific OUs in the group.

Set these on permission sets.

Users can have multiple values assigned.

member@organisation.org

staff@organisation.org

eduPersonScopedAffiliation

The 'targetedID' of the user. An opaque user ID that is provided by default for any OpenAthens federation user, and is in general use in all major federations.

It is persistent for a user so long as federation entityIDs do not change, however each publisher sees a different value.

If OpenAthens gets a SAML1 request the returned attribute is scoped, but not for SAML 2.

Will be replaced by PairwiseID in the future

Not generally used in the OpenAthens federation.

Set of URIs that assert compliance with specific standards for identity assurance.

These days entity categories are more likely to be used (See: https://wiki.refeds.org/display/ENT/Entity-Categories+Home).

http://blah.organisation.org/compliance/1

http://blah.organisation.org/compliance/2

http://blah.federation.net/agreement 

eduPersonAssurance

Not generally used in the OpenAthens federation.

Multi-valued set of previous eduPersonPrincipalNames the user may have had.

somthing@organisation.org

another@organisation.org 

eduPersonPrincipalNamePrior

A persistent user identifier that is expected to be unique within a single federation.

oifh845oi8sd85o87a4h@organisation.org

eduPersonUniqueId

Could be used in the OpenAthens federation

ORCID iDs are persistent digital identifiers for individual researchers. Their primary purpose is to unambiguously and definitively link them with their scholarly work products. ORCID iDs are assigned, managed and maintained by the ORCID organisation: http://orcid.org/

http://orcid.org/1234-5678-1234-5678

eduPersonOrcid

• HATINBZGYZDOZBZMZRGKNZTME3TMNBXGYYTIOBYGMYWKNLFMYYDAYY=@organisation.org