skip to primary navigationskip to content
 

Raven/Shibboleth Attribute Release Policy

This document sets out the policy observed by the managers of the University of Cambridge's institutional Shibboleth Identity Provider (IdP), as provided by Raven, in respect of release of attribute information. Transfer of attribute information is central to the operation of Shibboleth, however attribute values may represent 'personal data' under the terms of the Data Protection Act 1998 and processing and release of such data must abide by the provisions of the act. This policy ensures that the University does so.

See the Shibboleth attribute release summary for details of the currently implemented attribute rules.

This is version 6 of the policy approved by the UIS Deputy Director for Information Management on 19th October 2016.

1) All changes to this policy are approved by the Director of Information Services or his deputy.

2) Users are told about the IdP, and the fact that it may disclose information about them, the first time they use it to access a resource and at least annually thereafter. They are required to positively confirm that they accept the terms and conditions under which the IdP operates before proceeding and a record is made of this acceptance. On first access to a particular Shibboleth Service Provider (SP), users are made aware of the attributes that may be disclosed to it, along with their current values, and asked to approve this disclosure; this will be repeated at least annually and any time the list of attributes being disclosed to this SP changes.

3) The Shibboleth protocol requires that the SP have a copy of the University's Shibboleth metadata. This is available via HTTPS at https://shib.raven.cam.ac.uk/shibboleth for ad hoc use by SPs outside our set of known access federations.

4) The University institutional IdP provides three attributes to any SP that requests them. These are:

4.1) eduPersonScopedAffiliation with appropriate values (e.g. member@cam.ac.uk for members of the University, member@eresources.lib.cam.ac.uk for people entitled to access University Library-licenced electronic resources).

4.2) eduPersonTargetedID (an identifier allocated at random and distinct for each combination of user and SP, e.g. MlWd0XIR7juZvwvarOVdYiUWPW0=@cam.ac.uk).

4.3) eduPersonPrincipalName with the value <crsid>@cam.ac.uk (e.g. fjc55@cam.ac.uk).

5) Values for any other attributes (in particular eduPersonEntitlement, a 'catch-all' container for values specified by particular SPs, for example urn:mace:oclc.org:100159623 on behalf of anyone entitled to access the general University Library electronic resource collection, as required by OCLC FirstSerach), are released where there is a reasonable need, providing the corresponding user's identity can not be derived from these attributes or other information likely to be available to the SP. Where appropriate, SPs will only receive the particular extra attributes and values that they require.

6) Other attributes from or derived from the University Directory (Lookup), for example sn (e.g. Clark), displayName (e.g. Fred Clark), ou (e.g. Department of Important Studies), mail (e.g. fjc55@cam.ac.uk), University status (e.g. 'staff'), and groupID (e.g. 100123) may be released to SPs operated by the University, providing they have a privacy level of 'University' or 'World'.

7) Attributes from or derived from the University Directory (Lookup) may be released to SPs under contract to the University or Colleges solely for the purpose of the performance of that contract providing the contract provides an adequate levels of protection for the data concerned. The UIS will conduct due diligence prior to the authorisation of any such release under this clause. Service owners considering using this feature should contact UIS prior to entering into any contract for the provision of services that may depend on the release of such attributes. Each decision to allow or alter such a particular disclosure is approved by the Director of Information Services or his deputy before it is implemented and recorded in the schedule to this policy.

8) Other than as mentioned above, attributes and attribute values are only disclosed where there is a demonstrable need and where there are adequate levels of protection for the data concerned. Release of such information is only permitted where there is no alternative. Each decision to allow or alter such a particular disclosure is approved by the Director of University Information Services or his deputy before it is implemented and recorded in the schedule to this policy.

Schedule

Attribute and attribute value disclosure approved under section 7 above:

1) registered name ('cn', presented as initials and surname), and preferred email address ('mail') to Gartner. Inc (http://www.gartner.com).

2) registered name ('cn', presented as initials and surname), and preferred email address ('mail') to Room Booking Systems Ltd, 20-23 Woodside Place, Glasgow. SC366647.

3) CrsID ('uid'), registered name ('cn', presented as initials and surname), forename (when
available) and preferred email address ('mail') to Qualtrics LLC (https://www.qualtrics.com/).

4) registered name ('cn', presented as initials and surname), preferred email address ('mail') and University institution name ('ou') to Wellspring Worldwide, Inc. 350 N. LaSalle Street 12th Floor, Chicago, IL 60654 (http://www.wellspring.com/).

5) "dgyId" - Along with eduPerson Principal Name (eppn), we release "dgyId"
- the user's eppn converted to a format specifically for Digitary, Unit
3, Northwood House, Northwood Business Campus, Santry, Dublin 9, Ireland

Attribute and attribute value disclosure approved under section 8 above:

None

Getting help


UIS Service Desk
General support queries

  Phone padded  (01223 7) 62999

UAS Service Desk
Administrative staff queries

  Phone padded  (01223 3) 32999

UIS bITe-size bulletin


A regular newsletter aimed at the University's IT community, highlighting service and project news from UIS.

Sign up >  |  Back issues

UIS Service Status

Phone padded  Service status line: (01223) 463085
Website padded  Sign up for SMS/email status alerts

RSS Feed Latest news

Disruption to University websites expected today

Apr 18, 2019

There will be some brief disruption to University websites, including www.cam.ac.uk, today while we carry out essential maintenance. Apologies for any inconvenience caused.

All University members will get automatic access to Google G Suite@Cambridge on 2 May

Apr 18, 2019

UIS is enrolling all members of the University in our Google G Suite account, known as G Suite@Cambridge, on 2 May.

View all news