Please read the current version of the specification!
If you have any questions, please contact the DFN-AAI Team.
Please perform a protection needs assessment for the resources protected by the service provider. On this basis, you decide which criteria of the REFEDS Assurance Framework are relevant for the respective Service Provider and on the basis of which values of the eduPersonAssurance attribute the authorization decision has to be made (for which also other factors are usually decisive).
Important Notes:
eduPersonAssurance attribute should be declared as isRequired=true in the metadata administration tool under Attributes Consuming Service.In this example, access to the resources protected by the SP is granted to persons whose digital identity meets the conditions for $PREFIX$/IAP/medium and $PREFIX$/ATP/ePA-1m.
<Location /protected> AuthType shibboleth ShibRequestSetting requireSession true <RequireAll> Require shib-attr assurance https://refeds.org/assurance/IAP/medium Require shib-attr assurance https://refeds.org/assurance/ATP/ePA-1m </RequireAll> </Location>
As above - and the Service Provider only accepts the REFEDS Assurance Framework version 2.0.
<Location /protected> AuthType shibboleth ShibRequestSetting requireSession true <RequireAll> Require shib-attr assurance https://refeds.org/assurance/version/2 Require shib-attr assurance https://refeds.org/assurance/IAP/medium Require shib-attr assurance https://refeds.org/assurance/ATP/ePA-1m </RequireAll> </Location>
The following example assumes that only staff members (staff) of certain institutions, for whom $PREFIX$/ID/unique, $PREFIX$/IAP/medium und $PREFIX$/ATP/ePA-1m are met, are to be granted access to the resource protected by the service provider. The list of access-authorized identity providers or home institutions is defined via a metadata filter.
Please note: The attribute eduPersonAssurance is mapped to a variable named assurance by default in attribute-map.xml, in case of eduPersonAffiliation the variable is named unscoped-affiliation.
<Location /protected> AuthType shibboleth ShibRequestSetting requireSession true <RequireAll> Require shib-attr unscoped-affiliation staff Require shib-attr assurance https://refeds.org/assurance/ID/unique Require shib-attr assurance https://refeds.org/assurance/IAP/medium Require shib-attr assurance https://refeds.org/assurance/ATP/ePA-1m </RequireAll> </Location>
XML Access Control: For more ways to configure access control using the Shibboleth SP, please refer to the documentation provided by SWITCH