SRAM provides information to integrated applications in the form of attributes which describe properties of users or collaborations. Some of the data used to populate these attributes are provided by a user's home institution, while others are provided by the SRAM platform.
In keeping with the privacy policy, SRAM releases the minimum set of attributes necessary for authentication and authorization. Applications only receive attributes which concern the collaboration(s) to which the application is connected.
Below is a comprehensive table of the user attributes provided to applications by SRAM for use in authentication and authorization logic. The protocol used by the application to integrate with SRAM may have an effect on the received attributes and their schema.
Are there multiple attributes listed for a given protocol? This means that SRAM provides the same value in more than one attribute.
This is useful for certain applications which may prefer to use a given attribute over another.
User attributes
| Attribute | Description | Example(s) | SAML | OIDC | LDAP | SCIM |
|---|---|---|---|---|---|---|
Platform identifier | Unique, non-reassignable identifier suitable for use as a globally-unique external key. Best non-human readable identifier for a user. Consists of a hash value (random hex string) scoped to SRAM. Use this as your main identifier for users. | 9f3a7c1e6b2d4a8f5c0e9b71d3a6f4c2e8b1d5a7@sram.surf.nl |
|
|
|
|
Short platform identifier DEPRECATED | Human-readable platform identifier. This is a scoped version of the short username. Available for SAML and OIDC only. This attribute is deprecated and may be removed in future. |
|
|
|
|
|
| Short username | Short, human-readable username, provided by SRAM. |
|
|
|
|
|
| Name | Full name for display purposes, possibly including titles. |
|
|
|
|
|
| First name | First name |
|
|
|
|
|
| Surname | Last name |
|
|
|
|
|
| Email address | Primary email address Avoid using email address as your primary user identifier. Use platform identifier instead. |
|
|
|
| |
| Platform affiliation | SRAM platform affiliation. This attribute is currently filled with a static value: member@sram.surf |
|
|
|
|
|
Memberships: collaborations, collaboration groups, application groups | Membership of collaborations, collaboration groups, and application groups, expressed following AARC-G069 guidelines. Syntax: In the case of application groups, the | Ex. membership in a collaboration:
Ex. membership in a group inside a collaboration:
Ex. membership in an application group inside a collaboration
|
|
|
|
Note that this attribute is provided in the group schema and references (per group) the SCIM User identifier User.eduPersonUniqueID |
| Collaboration label(s) | Label(s) which are assigned to the user's collaboration(s) by the collaboration's providing organisation. The syntax is similar to that of collaboration and group memberships. Syntax: |
|
|
|
|
|
| SSH public key | Public SSH key which the user has configured to log into back-end systems. Only present if supplied by the user. | See SSH ciphers |
|
|
|
|
| Institutional identifier | User's identifier in their home institution. Only present if supplied by the user's home institution. |
|
|
|
|
|
| Institutional affiliation | User's role(s) in their home institution. Only present if supplied by the user's home institution. |
|
|
|
|
|
| Status | Status of the user; possible values are active and expired (for users whose membership has expired or who are inactive). Available for LDAP and SCIM only. | active |
|
|
|
|
| Inactive days | Approximate number of days since the user has authenticated to either SRAM or an SRAM connected application via SAML or OIDC, rounded down. Value can be one of:
Available for LDAP and SCIM only. |
|
|
|
|
|
Other attributes
In addition to the user attributes mentioned above, SRAM provides additional attributes about collaborations, groups, and/or applications via LDAP and/or SCIM:
Overview
Content Tools