| Subject ID othershow all attributes | |
| Name | subject-id |
| Description | This is a long-lived, non-reassignable, omni-directional identifier suitable for use as a globally-unique external key. Its value for a given subject is independent of the relying party to whom it is given. |
| Vocabulary | not applicable, no controlled vocabulary |
| References | SAML-subject-id |
| OIDC | n/a |
| OID | n/a |
| URN | urn:oasis:names:tc:SAML:attribute:subject-id |
| LDAP Syntax | Directory String |
| # of values | single |
| Example values |
|
The value consists of two substrings (termed a unique ID and a scope in the
remainder of this definition) separated by an @ symbol (ASCII 64) as an inline delimiter.
The unique ID consists of 1 to 127 ASCII characters, each of which is either an alphanumeric
ASCII character, an equals sign (ASCII 61), or a hyphen (ASCII 45). The first character MUST be
alphanumeric.
The scope consists of 1 to 127 ASCII characters, each of which is either an alphanumeric ASCII
character, a hyphen (ASCII 45), or a period (ASCII 46). The first character MUST be alphanumeric.
The scope deliberately resembles, and often is, a DNS domain name, but is drawn from a more limited character set
due to case folding considerations, and no attempt is made to limit the allowable grammar to legal domain names
(e.g., it allows consecutive periods).
The ABNF [RFC5234] grammar is therefore:
<value> = <uniqueID> "@" <scope>
<uniqueID> = (ALPHA / DIGIT) 0*126(ALPHA / DIGIT / "=" / "-")
<scope> = (ALPHA / DIGIT) 0*126(ALPHA / DIGIT / "-" / ".")
Value comparison MUST be performed case-insensitively (that is, values that differ only by case are the same, and MUST refer to the same subject).In the Switch edu-ID federation, home organizations MUST provide the same value as for swissEduPersonUniqueID .