Attributes for the UK federation

Attributes in Shibboleth are very important. They are the language in which access control and release policies are written and are the piece of the infrastructure for which avoiding unnecessary proliferation of names is most important. Shibboleth relies on consistent attribute naming to deliver information about browser users in a mutually understood way between the IdP and SP. Another way of thinking about it is that attributes are a named set of values which describe an authenticated user. The UK federation uses four agreed attributes: Attributes specified by SP's determine what the logged-in user can see on the web resource. These can be quite broad, such as student@xxx.ac.uk or quite granular such as the actual e-mail address of the subscribing organisation. In the latter case, this allows the SP to specify resources for different subscribers, such as medical resources, where broad teaching material can be differentiated from more specialised and focussed research. Attribute data store representations maps are held in a file called attribute-resolver.xml. These SAML representations are then made available to the web server and web applications in raw XML or through mappings performed using attribute-map.xml files. SP's have a list of required attributes as listed on this page. Non-UK federation member SP's may have different requirements which need to be assessed before deployment.