UCTrust Standard Attributes and SAML OIDs

UCnetID

urn:oid:2.16.840.1.113916.1.1.4.1

UCnetID, as assigned by UC's Universitywide Demographics Database.  The UCnetID is an integer that uniquely identifies a single member of the UC community.  This integer is transmitted between UCOP and the campuses in the form of a ten-character field with the digits representing the UCnetID left justified within the field.  Note that the number of digits in the UCnetID may be increased in the future.

UCTrustAssurance

urn:oid:2.16.840.1.113916.1.1.5

UCTrust Assurance.  This multivalued attribute defines the UCTrust assurance associated with a particular SAML-2 assertion.  Values for this attribute are of the form urn:mace:universityofcalifornia.edu:ucidentity:attributes:assurance:*

UC Campus Employee ID (PPS ID)

urn:oid:2.16.840.1.113916.1.1.6

UC Campus Employee ID. This single-valued attribute contains the nine-digit employee ID (including leading zeros), as defined by the Campus' Payroll/Personnel System (PPS) and issued by this IdP's campus. Scoped/qualified by the campus's top domain name [1] provided to InCommon. For example, 012345678@ucla.edu would be the value for the employee with PPS ID 012345678 at UCLA.

Note, existence of this value does NOT imply an individual is a current employee of the campus. Use eduPersonAffiliation, eduPersonPrimaryAffiliation or eduPersonScopedAffiliation to identify employees.

UCTrust Short Campus ID

urn:oid:2.16.840.1.113916.1.1.7

To facilitate a migration to long identifiers, UCTrustCampusIDShort, will be available for a limited transition period, no more than five years. It will not exceed 12 characters in length, it will contain only alphanumeric characters, and its persistence will not be greater than five years.

• It will be scoped in a non-standard way. The format will be two characters to designate the UC location, followed by no more than 10 alphanumeric characters assigned by that location. For example, “RI1234567890” could designate Jane Doe at UC Riverside. The following are the two-character location codes:
  
  • BE - UC Berkeley
  • DA - UC Davis
  • IR - UC Irvine
  • LA - UC Los Angeles
  • ME - UC Merced
  • RI - UC Riverside
  • SD - UC San Diego
  • SF - UC San Francisco
  • SB - UC Santa Barbara
  • SC - UC Santa Cruz
  • OP - UC Office of the President
  • LB - Lawrence Berkeley National Labs
• It will not be reassigned to more than one person by the same campus within the five-year lifetime of the identifier.
• Duplicate identifiers for an individual should be rare from a single campus, but are allowed.
• Duplicates will occur for people who are assigned UCTrustCampusIDShort's by multiple campuses.
• UCTrustCampusIDShort will be deprecated on or before July 1, 2012. If at any time before that date there are no current applications that need UCTrustCampusIDShort to operate, the UCTrust Work Group may choose to deprecate it sooner.

urn:oid:2.16.840.1.113916.1.1.8

This attribute was removed following UCTrust decision to map UCPathEmplid to the existing "inetOrgPerson:employeeNumber" value.

UCTrust

(reuse of inetOrgPerson)

UCPath Emplid, a value assigned by the UCPath HR system. This single valued attribute contains the 8 character employee id (including leading zeros) used to uniquely identify individuals stored in the UCPath system. These mostly consist of employees, but also include some contractor, volunteer and similar type affiliates.

Note that this OID is part of the inetOrgPerson defintion (specifically, it represents inetOrgperson::employeeNumber). The UCTrust-specific use of this OID is to define that it will contain the UCPath Emplid.

Note, existence of this value does NOT imply an individual is a current or past employee of the University. Use eduPersonAffiliation, eduPersonPrimaryAffiliation or eduPersonScopedAffiliation to identify employees.

UC Campus Student System ID. This single-valued attribute contains the individual's local student system ID as defined by the appropriate campus' Student Information System and issued by this IdP's campus, qualified by the campus's top domain name provided to InCommon. For example, 0111111@ucsc.edu would be the value for the person with the student system ID of 0111111 at UCSC. (While this example is only numeric, the identifier is allowed to be alpha-numeric).

Identifier lengths are not consistent across campuses, but a maximum identifier length of 36, not counting the campus scope[1], has been agreed to.

Note, existence of this value does NOT imply an individual is a current or past student of the campus. Use eduPersonAffiliation, eduPersonPrimaryAffiliation or eduPersonScopedAffiliation to identify student affiliations.

eduPersonPrincipleName

(aka ePPN)

Definition

A scoped identifier for a person. Basically, a common globally-unique SSO ID for the person associated with their campus.

It will take the form "user@scope" where 'user' is a location-assigned username and the "scope" is the campus' internet domain (e.g., campus.edu). 

Definition

Specifies the person's relationship(s) to the institution in broad categories such as student, faculty, staff, alum, etc. (See controlled vocabulary).

Permissible values

faculty, student, staff, alum, member, affiliate, employee, library-walk-in

Note: UCTrust members vary significantly in how these values are derived, making this value of limited value beyond as an informational/display element.

Current

Inconsistent

Deprecated

Inconsistent

Definition

A persistent, non-reassigned, opaque identifier for a principal (user) that is also unique to the service being accessed (typically to a specific entityID).

As an opaque identifier that is frequently generated "on the fly" during user login, the value is not easily human readable, or a value that users will know. See eduPerson schema definition.

Note that the spec for this attribute has evolved some over time, and as a result, UC locations implement the attribute slightly differently. This can on occasion cause processing difficulties for SPs receiving and processing TargetedID values.

Used to send information about what permissions a user should have within a source system. Only appropriate for cases where the IdP should directly control the user's access in a system.

See eduPerson schema definition.

Definition

ORCID iDs are persistent digital identifiers for individual researchers. Their primary purpose is to unambiguously and definitively link them with their scholarly work products (even as the researchers may change institutions). ORCID iDs are assigned, managed and maintained by the ORCID organization.

Contains the "First Name" of the individual.

As campuses implement support of the Gender Recognition and Lived Name policy (https://policy.ucop.edu/doc/2700693/GRLN), this will be expected to the user's Lived Name information.

Contains the "Last Name" of the individual.

As campuses implement support of the Gender Recognition and Lived Name policy (https://policy.ucop.edu/doc/2700693/GRLN), this will be expected to the user's Lived Name information.

Contains the "Full Name" of the individual.

As campuses implement support of the Gender Recognition and Lived Name policy (https://policy.ucop.edu/doc/2700693/GRLN), this will be expected to the user's Lived Name information.

Multi-valuedness?

Contains the "Display Name" of the individual. Originally this was intended to allow the user to personalize the display of their full name. (Including nicknames, displaying or suppressing middle names, etc.) Within UCTrust, it is largely synonymous with the cn value.

As campuses implement support of the Gender Recognition and Lived Name policy (https://policy.ucop.edu/doc/2700693/GRLN), this will be expected to the user's Lived Name information.

A user's email address as tracked in the UCTrust Location's SSO/IAM system.

Note, this value is not necessarily assigned by the location; in many cases it is just a collected value. It is not guaranteed to be in any specific format or have any particular domain (e.g., it might not be xxxx@campus.edu).

Be warned that this value is not generally a good choice for a userID, both because it is not stable - it may change or be reassigned to a different user over time - and because of the lack of controls around managing it - it is frequently self-reported by the user.

Many SaaS services treat email address as a Unique ID, but be warned of the concerns above before using it in this manner.

telephoneNumber

Some UCTrust locations make a job title available via this attribute. What values are contained will vary, and do not necessarily match any specific "official" value (e.g., may not match any specific UCPath Job-related field). It may be self-reported.

This is a text value that is generally only suitable for display purposes.

Some UCTrust locations make a job title available via this attribute. What values are contained will vary, and do not necessarily match any specific "official" value (e.g., may not match any specific UCPath Job or Department related field). It may be self-reported.

This is a text value that is generally only suitable for display purposes.