====== eduroamUID ======

The [[:cs:spravce:etlog|etlog]] system allows eduroam end users to show their activity. It is assumed that user's eduroam identity is equal to the ''[[https://www.eduid.cz/cs/tech/attributes/edupersonprincipalname|eduPersonPrincipalName]]'' attribute value. In other cases, organisational IdP might implement ''eduroamUID'' attribute where user's eduroam identity is defined.

In SAML message, the attribute is identified as ''<nowiki>http://eduroam.cz/attributes/eduroamUID</nowiki>''. Shibboleth IdP 3.x implementation (configuration file ''attribute-resolver.xml'') might look as following:

<file xml attribute-resolver-eduroamuid.xml>
<AttributeDefinition id="eduroamUID" xsi:type="ScriptedAttribute">
  <Dependency ref="uid" />
  <AttributeEncoder xsi:type="SAML1String" name="http://eduroam.cz/attributes/eduroamUID" />
  <AttributeEncoder xsi:type="SAML2String" name="http://eduroam.cz/attributes/eduroamUID" friendlyName="eduroamUID" />
  <Script>
    <![CDATA[
      if (typeof uid != "undefined" && uid != null) {
          eduroamUID.addValue (uid.getValues().get(0) + "@eduroam.%{idp.scope}");
      }
      ]]>
    </Script>
</AttributeDefinition>
</file>

An IdP have to release such an attribute at least to services with entityIDs ''<nowiki>https://monitor.eduroam.cz/shibboleth</nowiki>'' and ''<nowiki>https://attributes.eduid.cz/shibboleth</nowiki>''. To release ''eduroamUID'' attribute only to those services from //eduID.cz// federation, which request this attribute in their metadata, one might use the following rule (configuration file ''attribute-filter.xml''):

<file xml attribute-filter-eduroamuid.xml>
<AttributeFilterPolicy id="eduroamUID">

    <PolicyRequirementRule xsi:type="OR">
        <Rule xsi:type="InEntityGroup" groupID="https://eduid.cz/metadata" />
    </PolicyRequirementRule>

    <AttributeRule attributeID="eduroamUID">
        <PermitValueRule xsi:type="AttributeInMetadata" onlyIfRequired="false" />
    </AttributeRule>

</AttributeFilterPolicy>
</file>