Introduction

This document describes a simple method for encoding Higher Education affiliation information for use in interrealm authorization. The format is designed to be easy to read and parse while allowing sufficient flexibility for both coarse and fine descriptions. Although represented as a flat string, the affiliations are hierarchal, and easily translated into other formats, such as XML.

Affiliation Syntax

The format described here is syntactically derived from the format for domain names described in RFC 1034, as excerpted below, except that the maximum length of 63 characters per label is not imposed:
 <domain> ::= <subdomain> | " "

 <subdomain> ::= <label> | <subdomain> "." <label>

 <label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]

 <ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>

 <let-dig-hyp> ::= <let-dig> | "-"

 <let-dig> ::= <letter> | <digit>

 <letter> ::= any one of the 52 alphabetic characters A through Z in
 upper case and a through z in lower case

 <digit> ::= any one of the ten digits 0 through 9

 Note that while upper and lower case letters are allowed in domain
 names, no significance is attached to the case.  That is, two names with
 the same spelling but different case are to be treated as if identical.

 The labels must follow the rules for ARPANET host names.  They must
 start with a letter, end with a letter or digit, and have as interior
 characters only letters, digits, and hyphen.  There are also some
 restrictions on the length.  Labels must be 63 characters or less.
An affiliation consists of two portions, joined by a colon. The member field describes the actual affiliation within a given domain, specified by the sitedomain field. The sitedomain field must match the domain which the organization in question manages.

For purposes of member, domain becomes affiliation and subdomain becomes subaffiliation:

 <affiliation> ::= <member> ":" <sitedomain>

 <member> ::= <domain>

 <sitedomain> ::= <domain>

 <affiliation> ::= <subaffiliation> | " "

 <subaffiliation> ::= <label> | <subaffiliation> "." <label>

Affiliation Semantics

As with domain names, a dot represents a hierarchy separator. The leftmost portion of the affiliation string is the "smallest" or "most detailed" information. Arbitrary subaffiliations may become wildcards for searching purposes by substituting an asterisk (*) for the label.

The largest portion of the affiliation (rightmost, least detailed) determines the format for the more detailed portions of the affiliation. This portion is named the major affiliation for reference purposes.

There are two "special" major affiliations:

  1. person: The person affiliation provides a format for other affiliations. It is not by itself a major affiliation to be implemented.

    Format: time.role.ou.major:domain where

  2. local: The format for the subaffiliations of local are specific to the domain under which these affiliations exist. There is no guarantee of portability of local affiliations from one domain to another.

    Example: north.campus.local:university.edu

A site using this specification must define the following major affiliations, as defined by the EduPerson 1.0 specification, replacing university.edu with the appropriate local domain:

A site using this specification may additionally define major affiliations of the following formats:

A site wishing to not provide all the information described above may omit any subaffiliation provided all subaffiliations to its left (ie: more minor or specific subaffiliations) are also omitted.