IAM-verkoston tapaamisessa keskusteltiin avoimen yliopiston opiskelijoiden roolista. Monessa yliopistossa he käyvät samoja kursseja tuntkinto-opiskelijoiden kanssa, mutta eivät pääse samoihin resursseihin, koska eivät funetEduperson-skeeman perusteella voi saada eduPersonAffiliation-attribuutin arvoa student. IAM-verkoston tapaamisessa keskusteltiin mahdollisuudesta muuttaa Hakan attribuuttiskeemaa niin, että myös avoimen yliopiston opiskelijat laskettaisiin affiliation-attribuutin arvoon student.

Muutoksella voi olla vaikutuksia Hakan kotiorganisaation IdM-käytänteisiin ja esimerkiksi palvelujen lisensointiin mahdollisesti lisääntyvänä käyttäjämääränä. Muutos voi vaikuttaa myös palvelujen (SP - Service Provider) pääsynhallintaan. Muutoksen toteutuessa palvelut joutuisivat pääsynhallinnassa luottamaan funetEduPersonStudentCategory-attribuutin arvoon eduPersonAffiliation-attribuutin sijasta silloin, jos avoimen yliopiston opiskelijat halutaan poissulkea palvelun tai sen osan käyttöoikeudesta.

Jatkokeskustelua muutoksesta käydään parhaillaan IAM-verkoston sähköpostilistalla. Haka-operointi suosittaa kotiorganisaatioita seuraamaan keskustelua ja tarpeen mukaan osallistumaan siihen. Postilistan voi tilata ja sen arkistoa voi selata osoitteessa: https://postit.csc.fi/sympa/info/haka-iam .

Open university students to be added to eduPersonAffiliation student-value

There is an ongoing discussion about including open university students in eduPersonAffiliation-attribute with value student. The change may have an effect in Haka home organisations' IdM-practices and e.g. licensing costs. We suggest following the Haka-iam mailing list for IdM specialists in Haka home organisations. The discussion is held in Finnish.

If the proposal will be approved, the change may also affect Service Providers, if they want to use current granularity in authorisation. If open university students should be excluded after the change, the Service Provider shall need to use funetEduPersonStudentCategory attribute instead.

Please, see the Haka-iam mailing list (in Finnish): https://postit.csc.fi/sympa/info/haka-iam

  • No labels

2 Comments

  1. Kari Laalo AUTHOR

    We got questions about the reasoning to drive this change. I'm writing in English, because questions were in English. Mostly some Service Provider representatives have raised concerns.

    Some Haka home organisations have noted that currently open university students are not able to access same services and materials as qualifying students. However, the fact seems to be that open university students are attending the exact same courses and have basicly the same curriculum. Many open university students eventually become qualifying students after they have completed their approbatur (or whatever it is currently).

    Now, the problem is that open university students should be able to complete same requirements as qualifying students with lesser tools.

    Currently only few organisations populate funetEduPersonStudentCategory attribute, which would allow more fine grained approach for Service Providers to consider access to services. By considering open university students as students just like qualifying ones schemantics would resemble the real life situation better. By making funetEduPersonStudentCategory mandatory if eduPersonAffiliation attribute value student is populated, those services which need more fine grained approach, would be able to achieve it.

    The original reasoning can be found in materials of the IAM-verkosto meeting: https://wiki.eduuni.fi/display/IAMVERKOSTO/Yhteistapaaminen+20180118

  2. Kari Laalo AUTHOR

    And let me add, the haka-iam mailing list is targeted for higher education and research institutions in Finland. If you are a representative of a Haka partner, you can discuss the matter here in Haka blog comments (Eduuni-id authentication required). If that is not an option, please contact as described here.