Skip to content
Permalink
Browse files

Update identifier-guidance.adoc

  • Loading branch information
khazelton committed Oct 7, 2021
1 parent fa6dbb0 commit 6cbd8efdeb6ba39c246a25aab9b97877f8277839
Showing with 1 addition and 1 deletion.
  1. +1 −1 identifier-guidance.adoc
@@ -8,7 +8,7 @@ In this document, terminology on identifiers follows section 1.2 of _eduPerson 2
Example id name: iid, example id structure: UUID. Not name based.

*public IAM id*: generated by IAM system, can be asserted to other systems. Every person known to the IAM system gets one.
Example id name: subject-id. It is strongly recommended that adopters follow section 3.3.1 of _SAML V2.0 Subject Identifier Attributes Profile Version 1.0_, https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html, and be structured as 'uniqueId' + '@' + 'scope' where uniqueId is 1-127 alphanumeric characters (A-Z,0-9), or "-", or "=". The first character must be alphanumeric. Matches must be _case insensitive_. A uniqueId may be name-based or not at the choice of the deployer. Be aware that some applications will display the public IAM id in their UI.
Example id name: subject-id. It is strongly recommended that adopters follow section 3.3.1 of _SAML V2.0 Subject Identifier Attributes Profile Version 1.0_, https://docs.oasis-open.org/security/saml-subject-id-attr/v1.0/cs01/saml-subject-id-attr-v1.0-cs01.html, and be structured as 'uniqueId' + '@' + 'scope' where uniqueId is 1-127 alphanumeric characters (A-Z,0-9), or "-", or "=". The first character must be alphanumeric. Matches must be _case sensitive_ though lower-case values are recommended. A uniqueId may be name-based or not at the choice of the deployer. Be aware that some applications will display the public IAM id in their UI.

From SAML Attribute Profile, 3.3.1, "It is RECOMMENDED that the _unique ID be exclusively upper- or lower-case_ when expressed or stored to facilitate ease of comparison. Scope is separated from uniqueId by an "@" character, "It is RECOMMENDED that scopes be expressed in _lower case_, since they are...frequently, though not required to be, in the form of DNS domains"

0 comments on commit 6cbd8ef

Please sign in to comment.
You can’t perform that action at this time.