Add eduPersonAssurance attribute

[phavekes]

This issue is imported from pivotal

Add the eduPersonAssurance attribute to the eduID IDP login responses. Values to be used:

• https://refeds.org/assurance
• https://refeds.org/assurance/ID/unique
• https://refeds.org/assurance/ID/eppn-unique-no-reassign
• https://refeds.org/assurance/IAP/low

Voor versie twee is daarnaast nodig:

• https://refeds.org/assurance/version/2

If a user has an active account-link to an institution, and this institution provided https://refeds.org/assurance/IAP/medium or https://refeds.org/assurance/IAP/high, also add:

• https://refeds.org/assurance/IAP/medium

(This is still in discussion) If a user has used ID-card validation, also add:

• https://refeds.org/assurance/IAP/high

The above value is based on REFEDS Assurance Framework version V1.0. In the meantime the new V2.0 is released: https://refeds.org/wp-content/uploads/2023/12/RAF-2.0-Final-version.pdf

[phavekes]

Example SAML assertion

<samlp:Response xmlns:samlp=\'urn:oasis:names:tc:SAML:2.0:protocol\'
xmlns:saml=\'urn:oasis:names:tc:SAML:2.0:assertion\'
ID=\'...\' Version=\'2.0\' IssueInstant=\'2020-07-17T01:01:48Z\'
Destination=\'....\' InResponseTo=\'...\'>
...
<saml:Assertion ...>
...
<saml:AttributeStatement>
<saml:Attribute
NameFormat=\'urn:oasis:names:tc:SAML:2.0:attrname-format:uri\'
Name=\'urn:oid:1.3.6.1.4.1.5923.1.1.1.11\'
FriendlyName=\'eduPersonAssurance\'>
<saml:AttributeValue xsi:type=\'xsd:string\'>https://refeds.org/assurance</saml:AttributeValue>
<saml:AttributeValue xsi:type=\'xsd:string\'>https://refeds.org/assurance/ID/unique</saml:AttributeValue>
<saml:AttributeValue xsi:type=\'xsd:string\'>https://refeds.org/assurance/IAP/medium</saml:AttributeValue>
<saml:AttributeValue xsi:type=\'xsd:string\'>https://refeds.org/assurance/IAP/low</saml:AttributeValue>
<saml:AttributeValue xsi:type=\'xsd:string\'>https://refeds.org/assurance/IAP/local-enterprise</saml:AttributeValue>
</saml:Attribute>
...
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>
``` (Peter Havekes - Dec 14, 2022)

[phavekes]

See also:

• https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0
• https://wiki.surfnet.nl/display/coininfra/eduPersonAssurance+voor+PUHURI+MyAccessId
• https://spaces.at.internet2.edu/display/federation/user-attr-edupersonassurance (Peter Havekes - Dec 14, 2022)

[phavekes]

@thijskh please check my interpretation of the values (Peter Havekes - Dec 14, 2022)

[phavekes]

Medium kan alleen als de instelling zelf ook op medium zit, weet je niet generiek denk ik.

Voor id check, doe je dan ook gestolen etc check? (Thijs Kinkhorst - Dec 14, 2022)

[phavekes]

De gestolen-check moet worden gedaan door de software-leverancier van de ID-check backend (Peter Havekes - Dec 14, 2022)

[phavekes]

De eis voor `medium` aangepast naar:

If a user has an active account-link to an institution, and this institution provided https://refeds.org/assurance/IAP/medium or https://refeds.org/assurance/IAP/high, also add:

• https://refeds.org/assurance/IAP/medium (Peter Havekes - Dec 14, 2022)

[phavekes]

Ja, high kan je zelfstandig asserten als die vendor inderdaad zo'n actieve check doet en de zekerheid dat we te maken hebben met de legitieme bezitter van het document in principe 'hoog'achtig is. Je zou dan een soort betrouwbaarheidspercentage van de vetting moeten bepalen waarbij je dit accepteert als hoogbetrouwbaar. (Thijs Kinkhorst - Dec 14, 2022)

[phavekes]

Also add these attributes ans values to Mujina for testing (Peter Havekes - Aug 16, 2024)