...

Introduction

This specification defines standardised names and semantics for attributes that may be communicated within a SAML federation. The attribute set is intended as a reference data set of attributes that may be released to Relying Parties.

...

Where applicable, references to external attribute definitions are included, such as corresponding Object Identifiers (OIDs).

SAML Attribute Representation

When attributes defined in this specification are used, the following requirements apply:

• The <saml:Attribute> element represents an attribute in SAML 2.0.
• The NameFormat attribute MUST have the value urn:oasis:names:tc:SAML:2.0:attrnameformat:uri.
• The Name attribute MUST contain a URI as defined in this specification. Attribute names are expressed as URIs in the form of URLs.
• The FriendlyName attribute is OPTIONAL.
• The data type of the <AttributeValue> element is xs:string using UTF-8 encoding, unless otherwise specified in the attribute definition table. The type MAY be explicitly declared using xsi:type="xs:string".
• Attributes marked as non-multi-valued MUST NOT contain more than one <AttributeValue> element.
• Attributes marked as multi-valued MAY contain multiple <AttributeValue> elements.
• String matching SHOULD be performed using the caseIgnoreMatch rule as defined in X.520.

Example

The following example illustrates how attributes defined in this specification may be represented in a SAML 2.0 assertion issued by an Identity Provider.

...

    <saml2:AttributeValue 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:xs="http://www.w3.org/2001/XMLSchema"
        xsi:type="xs:string">
        vole-x2h5-qmgi@minorganisation.se
    </saml2:AttributeValue>

</saml2:Attribute>

Attribute Definitions

subject-id

The attribute is a technical identifier assigned by the subject’s home organization to uniquely identify the subject across Relying Parties within the federation.

...

pairwise-id

The attribute is a technical identifier assigned by the subject’s home organization to uniquely identify the subject on a per–Relying Party basis.

...

givenName

The given name (first name) of the subject.

sn

The surname (family name) of the subject.

displayName

A name that is suitable for display to end-users, typically a combination of given name and surname.

mail

The email address of the subject.

...

*) The mail attribute MUST be treated as a scoped attribute if and only if the applicable attribute release policy explicitly designates it as scoped. Otherwise, it MUST be treated as non-scoped.

telephoneNumber

The telephone number of the subject.

...

mobile

A mobile (cellular) telephone number of the subject.

...

o

The name of the organization to which the subject belongs.

ou

The name of an organizational unit within the organization to which the subject belongs.

...

organizationIdentifier

A unique identifier for the organization to which the subject is affiliated.

...