Affiliation Removal

Current affiliations are entirely controlled by their organizations. Switch never proactively creates, updates or deletes current affiliations.

Triggers to remove a current affiliation

A current affiliation is immediately removed if

  • either the organization sends a DELETE request on the affiliation API (if the organization uses the attribute push method),
  • or a person is removed from the list of members in the Attribute Provider API (pull via AP-API).

For organizations that have not yet integrated edu-ID in their identity management processes the validity of a current affiliation gets daily checked by issuing an attribute query to the organizational IdP (pull via SAML). A current affiliation is removed if

  • the organizational IdP responds with a "no user found" on 4 consecutive days. After the 4th day, the current affiliation is removed.

Removing a current affilation

The following actions are carried out when a current affiliation is removed:

  1. Organizational email addresses of the affiliation are removed from the list of possible login names (see next chapter).
  2. A former affiliation is created with a subset of personal data from the current affiliation. The internal attribute affiliation-period-end is set to the current date.
  3. The current affiliation is deleted. The user loses the related organizational membership state in the edu-ID identity. Services that require the organizational membership are no longer accessible by the user.
  4. An email is sent to the user with an information that the affiliation has been removed by the organization.

Note 1: A user may have multiple current affiliations. Removing one specific affiliation does not affect other current affiliations of the user.

E-mail address removal

As said above, organizational email addresses are removed from an edu-ID account together with an affiliation. Therefore, such an email address cannot be used anymore as login name. Hopefully, the user had added at least one alternative email address in order to have the possibility to login, or to reset the password. Switch maintains a list of domain names for email addresses of swiss universities.

If the organizational email address is the only email address in a person's edu-ID account, then the email address is not removed but deactivated after 10 days. Deactivation is done by appending .inactive to the address (Example: john.doe@example.com.inactive). If the user remembers the password, a login to the account management with the username <email>.inactive is possible, and further email addresses can be added. Of course, a password reset cannot be done with a deactivated email address.

If the users has no valid email address registered within the edu-ID account and doesn't remember the password it is impossible to access the account. Upon user request, such an account can be reactivated in a manual edu-ID support process.

Managing former affiliations

A former affiliation is automatically created whenever a current affiliation is deleted. The set of former affiliations of a user is the history of previously current affiliations.

Former affiliation management is only partially implemented so far. The following features are missing:

  • attributes of former affiliations can't be accessed by SPs
  • former affiliations can't be created other than by deleting a current affiliation. In the future an API or import interface may be available to retroactively add former affiliations.
  • The only way to delete a former affiliation is on user request via support.