Whenever a user attempts to access a connected service, WAYF forwards information about him to the service from the institution or identity provider where he authenticates. Each service receives only the minimum amount of user information required for the service provider to be able to deliver the service.
WAYF supports forwarding the kinds of user information, or attributes, listed below. Each attribute is defined – wrt. usage and form – by the standardisation body maintaining the schema to which the attribute belongs. The list below has a link to the authoritative definition of each attribute, and details any special usage within WAYF. The set of supported attributes is expanded as needed.
Values of attributes marked with an asterisk (*) WAYF’s identity providers MUST supply; other attributes they are free to supply to the extent that services utilised need them. Values of attributes marked with a double asterisk (**) have been approved by WAYF and are delivered by WAYF on behalf of the identity providers. For attributes marked with an obelisk (†) WAYF calculates those values not supplied by the identity provider himself, to the extent that the latter supplies a basis from which to calculate it, in the form of a value of a different attribute.
On the wire, WAYF will name the attributes either like in the list below or using the so-called URN:OID format. Each service provider can choose himself which of the two name formats WAYF will use in communicating with his service.
- cn* full name
- displayName† display name WAYF will be set to the value of cn if not supplied by the identity provider himself.
- eduPersonAffiliation† roles with the identity provider WAYF supplements based on the value of eduPersonPrimaryAffiliation.
- eduPersonAssurance* reliability of identity has a value of 3 for a verified user authenticated using multiple factors; a value of 2 if a verified user authenticated with a single factor; and a value of 1 if the user has not been verified at all by the identity provider.
- eduPersonEntitlement special rights at the service
- eduPersonPrimaryAffiliation* primary role with the identity provider in WAYF generally is staff for users on the identity provider's payroll; faculty and employee are not in systematic use.
- eduPersonPrincipalName* user ID with the identity provider
- eduPersonScopedAffiliation† roles at the identity provider's domain(s) in WAYF is also interpreted as the user's role within a group named @(group ID).org.dk, where org.dk is a domain of the identity provider's. WAYF supplements the set of values based on the values of eduPersonAffiliation and that of schacHomeOrganization.
- eduPersonTargetedID** persistent user ID at the service in WAYF has the format WAYF-DK-(hash value). Any particular value is, regrettably, reassignable to the extent that the corresponding eduPersonPrincipalName value is reassignable at the identity provider.
- gn* given names when NemID is the identity provider is set to the value of cn minus the last name in that value.
- mail e-mail addresses should not be used for identifying users, as WAYF does not guarantee its values being persistent nor unique to the user.
- organizationName* display name for the identity provider
- preferredLanguage preferred languages
- sn* surnames when NemID is the identity provider is set to the last name in the value of cn.
- schacCountryOfCitizenship† countries of citizenship
- schacHomeOrganization** identity provider's unique ID must be a DNS domain controlled by the identity provider.
- schacHomeOrganizationType** type of identity provider's organisation is higherEducationalInstitution if the organisation offers chiefly further-education programmes, educationalInstitution for other educational institutions, universityHospital for university hospitals, NRENAffiliate for the WAYF Orphanage and other for all other identity providers.
- schacPersonalUniqueID national unique ID contains the user's Danish CPR number, with the value formatted like urn:mace:terena.org:schac:personalUniqueID:dk:CPR:(CPR-no.-without-hyphen).
- schacDateOfBirth† date of birth if not supplied by the identity provider WAYF will calculate from the value of schacPersonalUniqueID.
- schacYearOfBirth† year of birth if not supplied by the identity provider WAYF will calculate from the value of schacPersonalUniqueID.
- norEduPersonLIN local identification number with the identity provider