Skip to content

check in eduID Luxembourg #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
restena-sw wants to merge 2 commits into
base: main
Choose a base branch
from
Open

check in eduID Luxembourg #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6466d3b
check in eduID Luxembourg
restena-sw Dec 6, 2024
b37fff1
SHA-256 hashes
restena-sw Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
167 changes: 167 additions & 0 deletions ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,167 @@
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<ConfigVersion>1.4</ConfigVersion>
<SPHashFile>SPHash.xml</SPHashFile>
<MetadataCacheFile>metadata.cached.xml</MetadataCacheFile>
<LocalRelyingPartyFile>get-ADFSTkLocalManualSPSettings.ps1</LocalRelyingPartyFile>

<MetadataPrefix>EDUID-LU-INTL-IDP</MetadataPrefix>
<MetadataPrefixSeparator>:</MetadataPrefixSeparator>

<eduPersonPrincipalNameRessignable>false</eduPersonPrincipalNameRessignable>

<Logging useEventLog="true">
<LogName>ADFSToolkit</LogName>
<Source>Import-ADFSTkMetadata</Source>
</Logging>

<metadataURL>https://eduid.lu/metadata/edugain-idp.xml</metadataURL>
<signCertFingerprint>5514E73B917DE18CFDA293297EBA737713B98A3418BF029E3EAF300916CDDFFA</signCertFingerprint>
<claimsProviders>
<claimsProvider>Active Directory</claimsProvider>
</claimsProviders>
<staticValues>
<o></o>
<co></co>
<c></c>
<schacHomeOrganization></schacHomeOrganization>
<norEduOrgAcronym></norEduOrgAcronym>
<schacHomeOrganizationType>urn:schac:homeOrganizationType:eu:educationInstitution</schacHomeOrganizationType>
<!-- This value is for EU higher education institution, other allowed values are:
urn:schac:homeOrganizationType:eu:educationInstitution
urn:schac:homeOrganizationType:int:NREN
urn:schac:homeOrganizationType:int:universityHospital
urn:schac:homeOrganizationType:int:NRENAffiliate
urn:schac:homeOrganizationType:int:other
-->
<ADFSExternalDNS></ADFSExternalDNS>
</staticValues>
<storeConfig>
<stores>
<store name="Active Directory" storetype="Active Directory" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="1" />
<!--<store name="Custom Store" storetype="Custom Store" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="2" />-->
<!-- <store name="SQL" storetype="SQL" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="3">
<query>SELECT CONVERT(varchar(10), Id) FROM [LiUDB].[dbo].[EmployeeIdGen] WHERE uid = REPLACE({0}, 'TEST\', '')</query>
</store> -->
</stores>
</storeConfig>
<transformRules>
<rule name="ADFSTkExtractSubjectUniqueId" originClaim="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" />
</transformRules>
<attributes>
<attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" store="Active Directory" name="givenname" />
<attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" store="Active Directory" name="sn" />
<attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname" store="Active Directory" name="displayname" />
<attribute type="http://schemas.xmlsoap.org/claims/CommonName" store="Active Directory" name="cn" />
<attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" store="Active Directory" name="name" />
<attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" store="Active Directory" name="mail" />

<!-- eduPersonAffilation and eduPersonScopedAffiliation settings
Scenario A. Static assignement with all active users declared 'member' (default)
Scenario B. Dynamic assignment based on GroupSID
Scenario C. Attribute ssignment based on presence of eduPersonAffiliation in directory

Note that EXAMPLE.COM is used where your domain scope is needed for easy search and replace for your domain.
This file is a template so commented out examples will NOT be updated


-->

<!-- Scenario A. Static assignment (default, comment out if you enable another technique
<attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Static" >
<value>member</value>
</attribute>
end Scenario A. Static assignment -->

<!-- note that in this template this field will be dynamically updated by eduPersonAfilliation above by new-ADFSTkConfiguration baking in the domain
<attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Static" >
</attribute>
end Scenario A. Static assignment -->


<!-- Scenario B. Dynamic assignment
<attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid">
<group name="SID-FOR-FACULTY-GROUP" value="faculty"/>
<group name="SID-FOR-STAFF-GROUP" value="staff"/>
<group name="SID-FOR-EMPLOYEE-GROUP" value="employee"/>
<group name="SID-FOR-STUDENT-GROUP" value="student"/>
<group name="SID-FOR-ALUM-GROUP" value="alum"/>
<group name="SID-FOR-AFFILIATE-GROUP" value="affiliate"/>
<group name="SID-FOR-MEMBER-GROUP" value="member"/>
<group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in"/>
</attribute>
<attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" >
<group name="SID-FOR-FACULTY-GROUP" value="faculty@EXAMPLE.COM"/>
<group name="SID-FOR-STAFF-GROUP" value="staff@EXAMPLE.COM"/>
<group name="SID-FOR-EMPLOYEE-GROUP" value="employee@EXAMPLE.COM"/>
<group name="SID-FOR-STUDENT-GROUP" value="student@EXAMPLE.COM"/>
<group name="SID-FOR-ALUM-GROUP" value="alum@EXAMPLE.COM"/>
<group name="SID-FOR-AFFILIATE-GROUP" value="affiliate@EXAMPLE.COM"/>
<group name="SID-FOR-MEMBER-GROUP" value="member@EXAMPLE.COM"/>
<group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in@EXAMPLE.COM"/>
</attribute>
end Scenario B. Dynamic assignment -->


<!-- Scenario C. Attribute assignment-->

<attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation">
<restrictedvalue>faculty</restrictedvalue>
<restrictedvalue>staff</restrictedvalue>
<restrictedvalue>employee</restrictedvalue>
<restrictedvalue>student</restrictedvalue>
<restrictedvalue>alum</restrictedvalue>
<restrictedvalue>affiliate</restrictedvalue>
<restrictedvalue>member</restrictedvalue>
<restrictedvalue>library-walk-in</restrictedvalue>
</attribute>

<attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" >
</attribute>

<!-- end Scenario C. Attribute assignment -->

<!-- Attribute filter pivoting on allowedRegistrationAuthorities - useful for GDPR purposes

Absence of allowedRegsitrationAuthorities - no action taken
Presence of allowedRegistrationAuthorities - attribute filters to be present in only said RA (one or more)
-->

<attribute type="urn:mace:dir:attribute-def:eduPersonUniqueID" store="Active Directory" name="norEduPersonLIN" />

<!-- Attention! You might need to filter this attribute on SP level before releasing it. -->
<attribute type="urn:mace:dir:attribute-def:eduPersonEntitlement" store="Active Directory" name="edupersonentitlement" />

<!-- Attention! Never send any AssuranceLevel(s) your institution isn't certified for -->
<!-- for definitions, see: https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0 -->
<attribute type="urn:mace:dir:attribute-def:eduPersonAssurance" store="Static">
<!-- uncomment if your identity store has specific institutional assurance policy statements. These are arbitrary to show where it is defined.

<value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al1</value>
<value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al2</value>
-->
<value>https://refeds.org/assurance</value>
<value>https://refeds.org/assurance/profile/cappuccino</value>
<value>https://refeds.org/assurance/ID/unique</value>
<value>https://refeds.org/assurance/ID/eppn-unique-no-reassign</value>
<value>https://refeds.org/assurance/IAP/low</value>
<!-- uncomment if your identity store satisfies the statements <value>https://refeds.org/assurance/IAP/medium</value> -->
<value>https://refeds.org/assurance/IAP/local-enterprise</value>
<!-- uncomment if used, will be sent for all records <value>https://refeds.org/assurance/ATP/ePA-1m</value> -->
<!--uncomment if used, will be sent for all records <value>https://refeds.org/assurance/ATP/ePA-1d</value>-->
</attribute>



<attribute type="urn:oasis:names:tc:SAML:attribute:pairwise-id" store="Active Directory" name="norEduPersonLIN">
<transformvalue adfstkstorefunction="pairwiseid" />
</attribute>

<attribute type="urn:oasis:names:tc:SAML:attribute:subject-id" store="Active Directory" name="samaccountname">
<transformvalue adfstkstorefunction="subjectid" />
</attribute>

<attribute type="http://schemas.xmlsoap.org/claims/samaccountname" store="Active Directory" name="samaccountname" />
<attribute type="http://schemas.xmlsoap.org/claims/Group" store="Active Directory" name="tokenGroups" />
</attributes>
</configuration>
Loading