NewsFilm Online

Initially posted on Tuesday, 29 July 2008

Online delivery of about 3,000 hours of downloadable video news stories (in 60,000 segmented encodings) and about 24,000 programme scripts from the ITN and Reuters archives.

Some of the most significant events of the past century are represented, and the broadest possible range of material has been selected to ensure relevance across a whole range of academic disciplines. Institutional subscription is free until at least 31 July 2012.

WAYFless URL: https://sp.edina.ac.uk/nfo/Shibboleth.sso/WAYF/UKFederation?providerId=xxx
(where xxx is the entity ID of your organisation's IdP)

Please note that WAYFless URLs cannot be guaranteed to remain unchanged over time.

This service is available for subscription to UK HE, FE & research councils through JISC Collections and is accessible through the JISC MediaHub.

Notes:

1. The only attribute that an identity provider must release for its users to be able to access many services that are licensed for use by everyone at a particular organisation is eduPersonScopedAffiliation. This is a scoped attribute, which might, for example, have the value "member" in scope "uni.ac.uk", often written as:

It is used for the basic authorisation decision: does uni.ac.uk subscribe to the service in question? If so, the user is allowed access. The service provider will maintain its own list of which organisations (scopes) can access its service. For allowed organisations, the federation's Technical Recommendations for Participants indicate that, in HE/FE, users with scoped affiliation values from the set {member, student, staff, faculty, employee} are typically authorised to access content licensed on the basis of the JISC Model Licence, while {affiliate, alum} are not.

An identity provider can generate eduPersonScopedAffiliation automatically (without an attribute store) by setting the required scope in resolver.xml, as described in SetupIdP.

2. Many services can make use of the eduPersonTargetedID attribute. This is a persistent opaque identifier, which enables service personalisation (remembering data about a user over different login sessions) without the service provider knowing who the user is. If the identity provider supplies the eduPersonTargetedID attribute, the session is treated similarly to an Athens personal account. Otherwise, the service's personalisation features (e.g., saved searches) may be disabled, though the service will still function in the same way as with Athens shared accounts. With some services (e.g., Zetoc Alert) this attribute is mandatory. If so, it is marked as "Required/Yes" in the table in Attribute Usage.

A Shibboleth identity provider can generate the opaque eduPersonTargetedID attribute automatically from some other stored attribute that holds the user id in the clear. All values of the stored attribute must be unique, and, preferably, not subject to reuse. If the only suitable available stored attribute might be reused then care must be taken (particularly for organisations asserting user accountability) to ensure that no value of that attribute is reallocated to another user for at least two years after being cancelled.

The actual modification depends on the contents of your directory, but if there is a suitable attribute in the directory called, say, "uid" then you should modify your resolver.xml file to include the following:

 
<PersistentIDAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonTargetedID"
                                 scope="SSSSSSSS" sourceName="uid">
   <DataConnectorDependency requires="directory"/>
   <Salt>XXXXXXXXXXXXXXXXXXXXXXX</Salt>
</PersistentIDAttributeDefinition>

Replace the scope "SSSSSSSS" with the domain for which the attribute is to be asserted, e.g., "uni.ac.uk". The <Salt> is a constant, arbitrary value that you should choose once and keep secret. The value must be at least 16 characters long, otherwise the software will silently ignore it and expect the value to be supplied from a Java keystore. The Salt value is used to generate the persistent opaque identifier from the scope and some other attribute, normally the user id (assumed in the example above to exist within the directory as an attribute called "uid"). Its purpose is to prevent attempts to work back from the opaque identifier to the user's identity by combining knowledge of the scope and the hash function used with an exhaustive search of the possible user ids.

The default Shibboleth attribute release policy does not release eduPersonTargetedID. You must therefore manually edit the arp.site.xml file to enable this feature, as described under Attribute Release below.

Please note a caveat about the definition of eduPersonTargetedID in some older versions of the resolver.xml file.