12345GÉANT Data Protection Code ofConduct
SAML 2.0 profile
For Service Providers established in European Union, European Economic Area andcountries with adequate data protection pursuant to Article 25.6 of the directive 95/46/EC

6Version 1.0, 14 June 2013

78910

© DANTE on behalf of the GN3plus project. Used under a Creative Commons Attribution ShareAlike license (CC BY-SA 3.0).

11The work leading to these results has received funding from the European Community’s Seventh Framework Programme (FP7 2007–2013)
under Grant Agreement No. 605243 (GN3plus).

121. Introduction

13141516171819This profile defines REQUIRED, RECOMMENDED, and OPTIONAL behavior for deployments supporting theData Protection Code of Conduct. This deployment profile is based on the Organization for the Advancement ofStructured Information Standards (OASIS) SAML 2.0 specifications [SAML2 Core, SAML2META]. It also
references elements defined in [SAML2MDUI], and makes use of an Entity Category element defined in Entity
Category Specification: Data Protection Code of Conduct [CoCEntityCategory]. The requirements from thosespecifications are not repeated here except where deemed necessary to highlight a point of discussion or draw
attention to an issue addressed in errata, but remain implied.

202122This document is supplemented by the non-normative Notes on Implementation of INFORM/CONSENT GUIInterfaces [CoCGUI] document which outlines the current best practice in the implementation and deploymentof Identity Provider side modules for attribute release and user consent.

2324

Note that the SAML features that are optional, or lack mandatory processing rules, are assumed to be optionaland out of scope of this profile if not otherwise precluded or given specific processing rules.

25
26

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT","RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

27

2. SAML Metadata Requirements for SP Entities28

1. mdui Requirements:29

1. SPs MUST provide at least one mdui:PrivacyStatementURL value.

30

2. It is RECOMMENDED that SPs provide at least one mdui:DisplayName value.

31

3. It is RECOMMENDED that SPs provide at least one mdui:Description value.

32334. For all mdui elements, at least an English version of the element MUST be available, indicatedby an xml:lang="en" attribute.

34

2. Attribute-related Requirements:

3536
37

1. SPs MUST provide RequestedAttribute elements describing attributes (and, optionally,requested values) relevant for the SP. The RequestedAttribute elements MUST include
the optional isRequired="true" to indicate that the attribute is necessary.

3839402. If the SP requires just one or some particular value(s) of an attribute (such as,eduPersonAffiliation="member"), the SP MUST use the saml:AttributeValueelement to indicate that value(s).

4142

3. SPs MUST provide an Entity Category attribute [CoCEntityCategory] value asserting compliance withthe Code of Conduct.

43

2.1 Display name44
45

A short descriptive name of the service, if possible without abbreviations. It SHOULD be meaningful both to theusers of the service and to readers not affiliated with the service.

46

This value may be displayed by various GUIs in order to identify the service.

47

Examples:48

Helsinki University's Moodle learning management system

49

University of Tübingen's Weblicht tool for linguistics research50

2.2 Description

51
52

A description which summarises the service provided. It SHOULD be meaningful both to the users of theservice and to readers not affiliated with the service.

53
54

This value may be displayed by various GUIs in order to summarise the purpose for which the service
processes personal data.

55

It is RECOMMENDED that the length of the description is no longer than 140 characters.

56

Examples:57

SAS-download gives access to SAS®-software for qualified users.

58
59

bibliotek.dk gives access to all public Danish libraries, and allows users to search for and ordermaterials.

60
61

WebLicht is a chaining tool for linguistics research. It provides an execution environment for automatic
annotation of text corpora.

62

2.3 Privacy Statement URL

63

A URL which resolves to a document that is the service's Privacy Policy.

64
65
66

This value may be displayed by various GUIs as a clickable link for the end user to provide more information on
how the service processes personal data. See Privacy policy guidelines for Service Providers[CoCPrivacyPolicy] for more information.

67
68

The PrivacyStatementURL MUST resolve to a document which is available to browser users without
requiring authentication of any kind.

69

2.4 Requested Attribute

70
71

Zero or more elements specifying attributes and, when applicable, attribute values requested by this service.
Having no RequestedAttribute element in place implies the service does not request any attributes.

72
73

If the Service Provider supports both SAML 1.x and SAML 2.0 protocols, it SHOULD list requested attributes
using only the SAML 2.0 attribute naming conventions [MACEDirAttrProf].

7475
76
77

Note: The underlying SAML 2.0 metadata standard is unable to express the attribute requirements ofsuch a Service Provider. The recommendation above is intended to minimise the chance ofinteroperability problems arising. It is further RECOMMENDED that such a Service Provider uses theSAML 2.0 protocol when possible rather than SAML 1.x.

78
79
80

A necessary attribute is indicated using the isRequired="true" XML attribute. In the context of this Data
protection Code of Conduct, an attribute is required only if it is both relevant and necessary for enabling accessto the service.

8182

isRequired="false" or a missing isRequired XML attribute indicates the attribute is optional (relevant,but only useful or desirable).

83
84
85
86

See What attributes are relevant for a Service Provider [CoCAttributes] document for assistance on thenecessary and optional attributes. See also Data protection good practice for Home Organisations[CoCHomeOrg] document for a good practice on managing the release of attributes flagged as necessary oroptional.

87
88

Note: Introduction to Code of Conduct [CoCIntroduction] proposes to defer the support to attributes flagged asoptional to Phase 2.

89

2.5 Entity Category: Data protection Code of Conduct

9091

An Entity Category attribute as defined in the Entity Category Specification: Data Protection Code of Conduct[CoCEntityCategory].

92

3. SAML Metadata Requirements for IDP Entities

93

Currently, there are no metadata requirements for IDPs.

94

4. Examples

95

Only related elements and attributes are presented.

96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

<EntityDescriptor entityID="https://filesender.funet.fi" ><Extensions><mdattr:EntityAttributes><saml:Attribute
Name="http://macedir.org/entity-category"NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue>
http://www.geant.net/uri/dataprotection-code-of-conduct/v1</saml:AttributeValue></saml:Attribute></mdattr:EntityAttributes></Extensions><SPSSODescriptor><Extensions><mdui:UIInfo><mdui:DisplayName xml:lang="fi">Funet FileSender</mdui:DisplayName><mdui:DisplayName xml:lang="en">Funet FileSender</mdui:DisplayName><mdui:Description xml:lang="fi">Funet FileSender tarjoaa helpon ja turvallisen tavan jakaa
suuria tiedostoja.
</mdui:Description><mdui:Description xml:lang="en">Funet FileSender offers an easy and a secure way to sharelarge files with anyone.
</mdui:Description><mdui:PrivacyStatementURL xml:lang="fi">https://filesender.funet.fi/privacypolicy.html</mdui:PrivacyStatementURL><mdui:PrivacyStatementURL xml:lang="en">https://filesender.funet.fi/privacypolicy.html</mdui:PrivacyStatementURL></mdui:UIInfo></Extensions><AttributeConsumingService><RequestedAttribute
FriendlyName="displayName"
Name="urn:oid:2.16.840.1.113730.3.1.241"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"isRequired="true"/><RequestedAttribute
FriendlyName="eduPersonPrincipalName"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"isRequired="true"/>

144
145
146
147
148
149
150
151

152

153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173

<RequestedAttribute
FriendlyName="mail"Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"isRequired="true"/></AttributeConsumingService></SPSSODescriptor></EntityDescriptor>

References[CoCAttributes]

Data protection Code of Conduct, “What Attributes Are Relevant for a Service Provider”,[CoCEntityCategory]

Data protection Code of Conduct, “Entity Category Specification”, Version 1.0, 14 June 2013

[CoCGUI]

Data protection Code of Conduct, “Notes on Implementation of INFORM/CONSENT GUI<https://refeds.terena.org/index.php/What_attributes_are_relevant_for_a_Service_Provider>Interfaces”,<https://refeds.terena.org/index.php/Notes_on_Implementation_of_INFORM/CONSENT_GUI_I
nterfaces>[CoCHomeOrg]

Data protection Code of Conduct, “Data Protection Good Practice for Home Organisations”,<https://refeds.terena.org/index.php/Data_protection_good_practice_for_Home_Organisations>[CoCIntroduction]

Data protection Code of Conduct, “Introduction to Code of Conduct”,[CoCPrivacyPolicy]

Data protection Code of Conduct, “Privacy Policy Guidelines for Service Providers”,<https://refeds.terena.org/index.php/Introduction_to_Code_of_Conduct><https://refeds.terena.org/index.php/Privacy_policy_guidelines_for_Service_Providers>[MACEDirAttrProf]

MACE-Dir, “SAML Attribute Profiles”, April 2008.

[SAML2 Core]OASIS, “Assertions and Protocol for the OASIS Security Markup Language (SAML) V2.0”, , 15
March 2005. Document Identifier: saml-core-2.0-os, <http://docs.oasisopen.org/security/saml/v2.0/saml-core-2.0-os.pdf>[SAML2META]

Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0 , with various
addenda, and in associated specifications.

[SAML2MDUI]SAML V2.0 Metadata Extensions for Login and Discovery User Interface Version 1.0.