[[PageOutline(1-5,Table of Contents,pullout)]]

'''Note''': this page is in the process of being updated (Oct 2017)

A good starting point for information about the Service Provider Federation is the public page https://www.clarin.eu/content/service-provider-federation

This wiki page contains the nitty-gritty technical details.

= [wiki:"./CLARIN IdP" CLARIN IdP]

See [wiki:InfrastructureOverview#CLARINIdentityProvider]

= [wiki:"./Discovery" Central Discovery Service]

See [wiki:InfrastructureOverview#DiscoveryService]

= Service Provider Federation

* for new SP admins: [https://cdn.rawgit.com/clarin-eric/SPF-tutorial/master/Shib_SP_tutorial.html Full tutorial about setting up a shibboleth Service Provider]

* for an overview about the metadata distribution in the SPF: [wiki:./DistributionMatrix Distribution Matrix: overview of manual SAML metadata updates]

* Information about including logos in SAML metadata: [https://wiki.refeds.org/display/FBP/MDUI+-+Software+recommendations recommendations] and a related [http://access.jiscinvolve.org/wp/can-we-standardise-on-mdui/ standardization discussion]

* [wiki:./LoginTest Login testing]: Manual testing of logins.

* Recommendations on [https://www.switch.ch/aai/support/certificates/certificate-acceptance/ certificates]: use self-signed ones for the SAML metadata and well-accepted ones for your webserver.

== Changing the SAML metadata about SPF SPs==

 * Fork the [https://github.com/clarin-eric/SPF-SPs-metadata CLARIN SPs metadata repository on github]
 * Commit the changes to the [https://github.com/clarin-eric/SPF-SPs-metadata/blob/master/clarin-sp-metadata.xml clarin-sp-metadata.xml metadata file] in your fork.
 * Create a pull request from your modified fork to the original repository.
 * After the pull request is created Travis CI will automatically run the [https://github.com/clarin-eric/SAML-metadata-checker SAML metadata checker] to check the '''XSD validity''' of the file. Wait for the check to finish and make sure you get a green check-mark in the end. If instead you see a red 'X' mark, please fix your commit based on TravisCI output information and update the pull request.
 * When your pull request successfully passes XSD validation, a CLARIN SPF operator will merge it into the original repository. Note: the SPF operators will only consider pull requests which are XSD valid for merging. If you cannot make you file successfully pass the XSD validation or you believe you are hitting a false positive. Please create a [https://github.com/clarin-eric/SPF-SPs-metadata/issues/new github issue] explaining the problem.
 * Every hour a cron job automatically checks out the latest production version and publishes it at http://infra.clarin.eu/aai/clarin-sp-metadata.xml

== How to add SAML metadata about the CLARIN IdP to your SP configuration == 
 * See the [https://cdn.rawgit.com/clarin-eric/SPF-tutorial/master/Shib_SP_tutorial.html#_specifying_spf_idps tutorial]

== Information per Identity Federation ==

(original [https://refeds.terena.org/index.php/Federations source] no longer available))

=== Haka (Finland) ===
cn, sn, displayName, eduPersonPrincipalName, schacHomeOrganization, schacHomeOrganizationType

The major unique identifier: Currently, ePPN is the predominant unique ID.

The federation operator has published instructions on use of ePTID but hasn't strongly insisted its use. 


=== DFN-AAI ===

==== attributes ====

sn, email, ePPN, ePSA, ePEntitlement, ePTID 

What is the predominant unique identifier for end users?
* eduPersonPrincipalName (ePPN)
* eduPersonTargetedID(ePTID)/SAML2 PersistentID

Is there a policy for what should be used as the unique ID? No.

=== SURFconext ===

Mandatory attributes: No mandatory attributes

The major unique identifier: eduPersonPrincipalName (ePPN) - there is no formal policy for what should be used as the unique ID 

=== UK federation ===

See section 7 of http://www.ukfederation.org.uk/library/uploads/Documents/technical-recommendations-for-participants.pdf for the recommended attributes in the UK.

== Requesting changes to the IdP blacklist==

* See [wiki:ServiceProviderFederation/IdpBlacklist SPF blacklist] information page.

== Attributes in the SPF ==

The '''minimal''' set of required attributes:
 * [http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonPrincipalName eduPersonPrincipalName] ''or'' [http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonTargetedID eduPersonTargetedID]

The '''ideal''' set of attributes:
  * [http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonPrincipalName eduPersonPrincipalName] ''or'' [http://middleware.internet2.edu/eduperson/docs/internet2-mace-dir-eduperson-200806.html#eduPersonTargetedID eduPersonTargetedID]
 * [https://rnd.feide.no/attribute/cn/ cn] (common name)
 * [https://rnd.feide.no/attribute/mail/ mail]
 * [https://rnd.feide.no/attribute/o/ o] (organizationName) ''or'' [http://wiki.rediris.es/gtschema/Iriseduperson#schacHomeOrganization schacHomeOrganization]

=== Attribute release ===

* [https://lindat.mff.cuni.cz/secure/attributes.xml automatically produced, current overview]
* [http://www.clarin.eu/page/3578 older (outdated, manually maintained) overview]

== Attributes requested by SPF services ==

These should be listed in the SAML metadata about the SP - see recommendation 8 (attributeconsumingservice) of https://www.clarin.eu/content/guidelines-saml-metadata-about-your-sp