Identity providers in YETKİM are required to produce and release the following attributes as defined here, for interoperability within YETKİM and across eduGAIN.
| Attribute | OID | Values |
|---|---|---|
| givenName | urn:oid:2.5.4.42 | single |
| sn | urn:oid:2.5.4.4 | single |
| displayName | urn:oid:2.16.840.1.113730.3.1.241 | single |
urn:oid:0.9.2342.19200300.100.1.3 | multiple | |
| schacHomeOrganization | urn:oid:1.3.6.1.4.1.25178.1.2.9 | single |
| schacHomeOrganizationType | urn:oid:1.3.6.1.4.1.25178.1.2.10 | multiple |
| eduPersonAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.1 | multiple |
| eduPersonScopedAffiliation | urn:oid:1.3.6.1.4.1.5923.1.1.1.9 | multiple |
| eduPersonPrincipalName | urn:oid:1.3.6.1.4.1.5923.1.1.1.6 | single |
| eduPersonTargetedID | urn:oid:1.3.6.1.4.1.5923.1.1.1.10 | multiple |
| eduPersonEntitlement | urn:oid:1.3.6.1.4.1.5923.1.1.1.7 | multiple |
| schacPersonalUniqueCode | urn:oid:1.3.6.1.4.1.25178.1.2.14 | multiple |
Values: single means the attribute holds exactly one value, multiple means it can hold more than one.
The person's given name.
urn:oid:2.5.4.42Ayşe FatmaMehmet AliThis attribute can normally hold several values, for example Mehmet and Ali for Mehmet Ali. In YETKİM it must be used once, as Mehmet Ali.
The person's surname.
urn:oid:2.5.4.4KayaYıldız ŞahinThis attribute can normally hold several values, for example Yıldız and Şahin, or even Yıldız-Şahin, for Yıldız Şahin. In YETKİM it must be used once, as Yıldız Şahin.
The person's preferred name for display. Usually givenName sn.
urn:oid:2.16.840.1.113730.3.1.241Elif DeğerliAhmet KaraThe person's e-mail address.
urn:oid:0.9.2342.19200300.100.1.3ahmet.yigit@ankara.edu.trelifk@ankara.edu.trMay hold several values, but an institutional address of the form kullanici@universite.edu.tr is preferred.
The domain name of the person's home organisation.
urn:oid:1.3.6.1.4.1.25178.1.2.9istanbul.edu.trThe type of the person's home organisation.
urn:oid:1.3.6.1.4.1.25178.1.2.10urn:schac:homeOrganizationType:int:universityurn:schac:homeOrganizationType:int:researchHospitalurn:schac:homeOrganizationType:int:nrenurn:schac:homeOrganizationType:int:otherUniversities in YETKİM must use urn:schac:homeOrganizationType:int:university.
The person's relationship to the institution (broad category).
urn:oid:1.3.6.1.4.1.5923.1.1.1.1studentfacultymemberThis attribute takes one or more of the following values:
facultystudentstaffmemberaffiliatealumlibrary-walk-in| Person | Values |
|---|---|
| Academic staff | facultymember |
| Student | studentmember |
| Administrative staff | staffmember |
| Research assistant who is a PhD student | facultystudentmember |
| Administrative staff doing a master's degree | staffstudentmember |
| Parent of a student | affiliate |
| Graduate | alum |
| Full employee not described as staff, faculty or student | member |
If the attribute contains faculty, staff or student, it must also contain member.
The person's affiliation within a given security domain (scope), broad category.
urn:oid:1.3.6.1.4.1.5923.1.1.1.9student@izmir.edu.trfaculty@izmir.edu.trmember@izmir.edu.trThe value has the form x@y. x is one of the values allowed in eduPersonAffiliation (such as student or faculty). y is the security domain (scope) and equals the part of eduPersonPrincipalName after the @.
For example, if your scope is izmir.edu.tr:
student@izmir.edu.tr, member@izmir.edu.trfaculty@izmir.edu.tr, member@izmir.edu.trService providers use this attribute often, because its value carries both the person's relationship to the institution and the institution itself.
A scoped identifier for the person.
urn:oid:1.3.6.1.4.1.5923.1.1.1.6elif.kocak@adana.edu.trefy24@adana.edu.trThe value must have the form user@scope. user must be unique within the scope; two people in the same scope cannot share it. A user@scope value that has been used must never be assigned to another person.
Although the value looks like, and is often the same as, an e-mail address, it must not be used as one.
It usually has a readable value such as ayse.gezer@bursa.edu.tr, but it does not have to: 743567@bursa.edu.tr is valid too.
As a rule, a user value used in a scope should not be reused and a person's value should not change. Institutions may be unable to follow this rule in exceptional cases, so service providers relying on eduPersonPrincipalName should take that into account.
A persistent, non-reassigned, opaque and targeted identifier for the person.
urn:oid:1.3.6.1.4.1.5923.1.1.1.10<saml:NameID
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
NameQualifier="https://kimlik.universite.edu.tr/simplesaml/saml2/idp/metadata.php"
SPNameQualifier="https://sp.servis.com.tr/simplesaml/module.php/saml/sp/metadata.php/ornek-servis"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
1e4774a0270be2d549196deebb61b1f20d183bc4
</saml:NameID>An attribute form of the SAML 2.0 name identifier (NameID) in the urn:oasis:names:tc:SAML:2.0:nameid-format:persistent format. Its value is a tuple of a person identifier, the service provider's entityID and the identity provider's entityID.
The NameID is carried in the SAML assertion the identity provider sends after authentication and identifies the subject. It is not an attribute itself.
The persistent NameID, and so eduPersonTargetedID, is usually computed by an algorithm from the values of certain attributes and a salt. For the result to be unique for all time, the attributes used must be unique for all time as well.
For example, a username attribute cannot be used, because the same username may be given to someone else two years later. Today's ali and the ali two years from now may be different people, yet both would get the same identifier.
If, on the other hand, a uid attribute holds an identifier that is unique to the person and will never be reused (a unix user id or a UUID), it can be used. username alone is not enough, but username together with the account creation date creationDate can be unique for all time and both can be used in the computation.
The person's entitlements to specific resources. Values are URIs (URL or URN).
urn:oid:1.3.6.1.4.1.5923.1.1.1.7urn:mace:dir:entitlement:common-lib-termshttps://kimlik.diyarbakir.edu.tr/entitlement/proxy/Values and their meaning are usually defined by service providers. For example, people with https://kimlik.diyarbakir.edu.tr/entitlement/proxy/ can use the diyarbakir.edu.tr proxy service, and people with https://kimlik.diyarbakir.edu.tr/entitlement/proxy/admin are administrators of it.
People with urn:mace:dir:entitlement:common-lib-terms can access the Elsevier ScienceDirect database.
A service provider can define entitlements for its service and leave assigning them to home organisations. In the proxy example above, user and administrator rights are granted by the home organisation (identity provider) through eduPersonEntitlement, and nothing is assigned on the service side.
A unique code associated with the person, such as a student or staff number.
urn:oid:1.3.6.1.4.1.25178.1.2.14urn:schac:personalUniqueCode:int:esi:sinop.edu.tr:54332-7urn:schac:personalUniqueCode:int:esi:kars.edu.tr:O92435This attribute carries the European Student Identifier (ESI). The ESI is globally unique, persistent, non-targeted, protocol neutral and data transport neutral.
In YETKİM the ESI must be expressed as:
urn:schac:personalUniqueCode:int:esi:<sHO>:<code><sHO>sinop.edu.tr<code>54332-7 or O92435. It must meet the requirements in RFC 2141 sections 2.2 to 2.4.Within <sHO>, a <code> must always point to one student and allow the student record to be found. It is usually the student number. Using the Turkish national ID number is strongly discouraged.
Releasing this attribute is required for smooth access to Erasmus Without Paper services. The value must not exceed 255 characters in total.