Switch edu-ID identities are capable of representing a comprehensive set of user information. The illustration below shows an example set of attributes that could be represented for an indiviual in her edu-ID identity. It consists of the following components:
The personal identity (mandatory): It contains the authentication credentials and at least the first name, last name and an email address. The edu-ID system automatically adds some identifiers and metadata. The personal edu-ID identity is managed by the individual.
An affiliation identity is added to an edu-ID identity when the individual becomes a member of an organization, commonly as a student or staff member. As an individual may be affiliated with more than one organization at a time - e.g. a student at one organization and staff at another – an edu-ID identity may contain multiple current affiliations (0, 1 or more). Affiliation identities are created and updated by organizations.
When an individual leaves the organization the respective current affiliation identity is transformed into a former affiliation with a reduced set of attributes. The former affiliations thus form the affiliation history of an individual.
Some services may require group membership information to grant a person access to specific resources. An edu-ID identity is capable of representing group memberships in the entitlement attribute.
The Switch edu-ID IdP supports two basic methods how attribute information can be made available to services.
The affiliation identity configuration is fully compatible with services that were built to work with individual organizational IdPs in the pre-edu-ID era. It is the standad model for most use cases.
The personal identity configuration is intended for services that are to be accessible to individuals without university affiliation.
The extended identity configuration is capable of providing a comprehensive set of attributes to services. A service can use this model on request. Additional legal conditions must be complied with by the service.