MyIntute: new service from MIMAS

Initially posted on Monday, 28 September 2009

Intute is a JISC funded service that helps students find the best web resources for their studies and research. MyIntute is the personal workspace on Intute where users can store and manage their individual selection of content from the Intute catalogue.

Registered users:

* Save records and tag them with their own headings
* E-mail selected records or export them
* Set up e-mail or RSS alerts of new records added to the Intute

These services can also be used by institutions to create subject guides for internet resources on their websites which are then dynamically updated when Intute edits the catalogue.

Note:

2. Many services can make use of the eduPersonTargetedID attribute. This is a persistent opaque identifier, which enables service personalisation (remembering data about a user over different login sessions) without the service provider knowing who the user is. If the identity provider supplies the eduPersonTargetedID attribute, the session is treated similarly to an Athens personal account. Otherwise, the service's personalisation features (e.g., saved searches) may be disabled, though the service will still function in the same way as with Athens shared accounts. With some services (e.g., Zetoc Alert) this attribute is mandatory. If so, it is marked as "Required/Yes" in the table in Attribute Usage.

A Shibboleth identity provider can generate the opaque eduPersonTargetedID attribute automatically from some other stored attribute that holds the user id in the clear. All values of the stored attribute must be unique, and, preferably, not subject to reuse. If the only suitable available stored attribute might be reused then care must be taken (particularly for organisations asserting user accountability) to ensure that no value of that attribute is reallocated to another user for at least two years after being cancelled.

The actual modification depends on the contents of your directory, but if there is a suitable attribute in the directory called, say, "uid" then you should modify your resolver.xml file to include the following:

 
<PersistentIDAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonTargetedID"
                                 scope="SSSSSSSS" sourceName="uid">
   <DataConnectorDependency requires="directory"/>
   <Salt>XXXXXXXXXXXXXXXXXXXXXXX</Salt>
</PersistentIDAttributeDefinition>

Replace the scope "SSSSSSSS" with the domain for which the attribute is to be asserted, e.g., "uni.ac.uk". The <Salt> is a constant, arbitrary value that you should choose once and keep secret. The value must be at least 16 characters long, otherwise the software will silently ignore it and expect the value to be supplied from a Java keystore. The Salt value is used to generate the persistent opaque identifier from the scope and some other attribute, normally the user id (assumed in the example above to exist within the directory as an attribute called "uid"). Its purpose is to prevent attempts to work back from the opaque identifier to the user's identity by combining knowledge of the scope and the hash function used with an exhaustive search of the possible user ids.

The default Shibboleth attribute release policy does not release eduPersonTargetedID. You must therefore manually edit the arp.site.xml file to enable this feature, as described under Attribute Release below.

Please note a caveat about the definition of eduPersonTargetedID in some older versions of the resolver.xml file.