The Switch edu-ID uses existing OIDC features to support the various identity models. Clients can be configured to support any of the models and specify from which provider (i.e. home organisation) identities are accepted. Find more information about these models on Identity and Attributes.
Find below a high-level documentation of identity selection for OIDC. This should be enough for most client operators to use this feature properly. For a detailed specification, take a look at the RFC.
You can restrict access to your client to a certain audience. There are two options to restrict the audience. These methods can be used individually or in combination. Eventually, the end user might need to select the identity to be released.
You can find details on how to configure intended audiences via the Resource Registry in our Identity Models documentation.
Clients can use the claims parameter in the OIDC authorization request as documented in the core specification in order to restrict the value of the eduid_idp claim (documented on Scopes and Claims). By restricting the possible values for this claim in the response, the client indicates that only identities from specific providers (home organisations) are allowed.
This method can be useful if the client needs to be able to request specific intended audiences in certain contexts, for instance if a page should only be accessible by identities of a certain provider. Otherwise, restricting by the Resource Registry Intended Audience is generally the easier solution.
The following is an example of a claim request within the authorization request, which enforces the identity to be provided either by uni-demo.ch (an affiliation identity) or by eduid.ch (the self-provided personal identity).
"claims": {
"id_token": {
"eduid_idp": {
"essential": true,
"values": ["uni-demo.ch", "eduid.ch"]
}
}
}
The complete authorization request could then look like this:
https://login.eduid.ch/idp/profile/oidc/authorize?
response_type=code
&client_id=unidemo_moodle
&scope=openid%20https%3A%2F%2Feduid.ch%2Fscope%2Fuserinfo.read
&redirect_uri=https%3A%2F%2Fclient.example.org%2Fredirect
&state=af0ifjsldkj
&claims=%7B%22id_token%22%3A%7B%22eduid_idp%22%3A%7B%22essential%22%3Atrue%2C%22values%22%3A%5B%22uni-demo.ch%22%2C%22eduid.ch%22%5D%7D%7D%7D
In the JSON, instead of the values parameter (which is an array of allowed values), you can also use value (a string) instead to request an identity from one specific provider. Find details about the structure of this claims request parameter in the core specification.
After authentication of the end user, the edu-ID OP computes a set of available identities which are still available after filtering according to the restrictions given by the Resource Registry Intended Audience and the requested claims in the authorization request. The end user will then face one of these scenarios:
The client can see the provider of the identity that has been released in the eduid_idp claim in the ID Token. Note that the iss (issuer) claim has always value https://login.eduid.ch/ (resp https://login.test.eduid.ch/ for the test federation).
The sub (subject) claim is computed based on the identity that has been selected. See Scopes and Claims for more details on this claim.
Find more information about the ID Token in our Token documentation.
The userInfo endpoint is where generally user-related claims should be fetched from. The claims correspond to those of the released identity. See Scopes and Claims for more information about how to get the claims.