From 6466d3b5d8de8202f67a4b8dc19582b0125d3a38 Mon Sep 17 00:00:00 2001
From: Stefan Winter <stefan.winter@restena.lu>
Date: Fri, 6 Dec 2024 17:07:10 +0100
Subject: [PATCH 1/2] check in eduID Luxembourg

---
 .../EDUID-LU-INTL-IDP_defaultConfigFile.xml   | 167 ++++++++++++++++++
 .../EDUID-LU-INTL-SP_defaultConfigFile.xml    | 164 +++++++++++++++++
 .../EDUID-LU/EDUID-LU_defaultConfigFile.xml   | 167 ++++++++++++++++++
 3 files changed, 498 insertions(+)
 create mode 100644 ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
 create mode 100644 ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml
 create mode 100644 ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml

diff --git a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
new file mode 100644
index 0000000..34b019c
--- /dev/null
+++ b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <ConfigVersion>1.4</ConfigVersion>
+    <SPHashFile>SPHash.xml</SPHashFile>
+    <MetadataCacheFile>metadata.cached.xml</MetadataCacheFile>
+    <LocalRelyingPartyFile>get-ADFSTkLocalManualSPSettings.ps1</LocalRelyingPartyFile>
+
+    <MetadataPrefix>EDUID-LU-INTL-IDP</MetadataPrefix>
+    <MetadataPrefixSeparator>:</MetadataPrefixSeparator>
+
+    <eduPersonPrincipalNameRessignable>false</eduPersonPrincipalNameRessignable>
+
+    <Logging useEventLog="true">
+      <LogName>ADFSToolkit</LogName>
+      <Source>Import-ADFSTkMetadata</Source>
+    </Logging>   
+
+    <metadataURL>https://eduid.lu/metadata/edugain-idp.xml</metadataURL> 
+    <signCertFingerprint>B8EC5AEFEA01767EF08DC26600769EB328910B97</signCertFingerprint>
+	  <claimsProviders>
+        <claimsProvider>Active Directory</claimsProvider>
+    </claimsProviders>
+    <staticValues>
+		<o></o>
+        <co></co>		
+        <c></c>
+		<schacHomeOrganization></schacHomeOrganization>
+		<norEduOrgAcronym></norEduOrgAcronym>
+		<schacHomeOrganizationType>urn:schac:homeOrganizationType:eu:educationInstitution</schacHomeOrganizationType>
+		<!-- This value is for EU higher education institution, other allowed values are:
+			urn:schac:homeOrganizationType:eu:educationInstitution
+			urn:schac:homeOrganizationType:int:NREN
+			urn:schac:homeOrganizationType:int:universityHospital
+			urn:schac:homeOrganizationType:int:NRENAffiliate
+			urn:schac:homeOrganizationType:int:other
+		-->
+		<ADFSExternalDNS></ADFSExternalDNS>
+	</staticValues>
+    <storeConfig>
+        <stores>
+            <store name="Active Directory" storetype="Active Directory" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="1" />
+            <!--<store name="Custom Store" storetype="Custom Store" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="2" />-->
+           <!-- <store name="SQL" storetype="SQL" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="3">
+                <query>SELECT CONVERT(varchar(10), Id) FROM [LiUDB].[dbo].[EmployeeIdGen] WHERE uid = REPLACE({0}, 'TEST\', '')</query>
+            </store> -->
+      </stores>
+    </storeConfig>
+      <transformRules>
+        <rule name="ADFSTkExtractSubjectUniqueId" originClaim="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" /> 
+      </transformRules>
+        <attributes>
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" store="Active Directory" name="givenname" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" store="Active Directory" name="sn" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname" store="Active Directory" name="displayname" />
+            <attribute type="http://schemas.xmlsoap.org/claims/CommonName" store="Active Directory" name="cn" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" store="Active Directory" name="name" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" store="Active Directory" name="mail" />
+           
+           <!-- eduPersonAffilation and eduPersonScopedAffiliation settings
+                Scenario A. Static assignement with all active users declared 'member' (default)
+                Scenario B. Dynamic assignment based on GroupSID
+                Scenario C. Attribute ssignment based on presence of eduPersonAffiliation in directory
+             
+             Note that EXAMPLE.COM is used where your domain scope is needed for easy search and replace for your domain.
+             This file is a template so commented out examples will NOT be updated
+            
+             
+             -->
+
+             <!-- Scenario A. Static assignment (default, comment out if you enable another technique
+             <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Static" >
+               <value>member</value>
+             </attribute>
+             end Scenario A. Static assignment -->
+
+             <!-- note that in this template this field will be dynamically updated by eduPersonAfilliation above by new-ADFSTkConfiguration baking in the domain
+              <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Static" >
+              </attribute>
+             end Scenario A. Static assignment -->
+
+
+              <!-- Scenario B. Dynamic assignment 
+     <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid">
+                <group name="SID-FOR-FACULTY-GROUP" value="faculty"/>
+                <group name="SID-FOR-STAFF-GROUP" value="staff"/>
+                <group name="SID-FOR-EMPLOYEE-GROUP" value="employee"/>
+                <group name="SID-FOR-STUDENT-GROUP" value="student"/>
+                <group name="SID-FOR-ALUM-GROUP" value="alum"/>
+                <group name="SID-FOR-AFFILIATE-GROUP" value="affiliate"/>
+                <group name="SID-FOR-MEMBER-GROUP" value="member"/>
+                <group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in"/>
+            </attribute>
+      <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" >
+                <group name="SID-FOR-FACULTY-GROUP" value="faculty@EXAMPLE.COM"/>
+                <group name="SID-FOR-STAFF-GROUP" value="staff@EXAMPLE.COM"/>
+                <group name="SID-FOR-EMPLOYEE-GROUP" value="employee@EXAMPLE.COM"/>
+                <group name="SID-FOR-STUDENT-GROUP" value="student@EXAMPLE.COM"/>
+                <group name="SID-FOR-ALUM-GROUP" value="alum@EXAMPLE.COM"/>
+                <group name="SID-FOR-AFFILIATE-GROUP" value="affiliate@EXAMPLE.COM"/>
+                <group name="SID-FOR-MEMBER-GROUP" value="member@EXAMPLE.COM"/>
+                <group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in@EXAMPLE.COM"/>
+        </attribute> 
+               end Scenario B. Dynamic assignment -->
+
+
+           <!-- Scenario C. Attribute assignment-->
+             
+           <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation">
+              <restrictedvalue>faculty</restrictedvalue>
+              <restrictedvalue>staff</restrictedvalue>
+              <restrictedvalue>employee</restrictedvalue>
+              <restrictedvalue>student</restrictedvalue>
+              <restrictedvalue>alum</restrictedvalue>
+              <restrictedvalue>affiliate</restrictedvalue>
+              <restrictedvalue>member</restrictedvalue>
+              <restrictedvalue>library-walk-in</restrictedvalue>
+            </attribute>
+            
+             <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" >
+            </attribute>
+       
+            <!-- end Scenario C. Attribute assignment -->
+
+            <!-- Attribute filter pivoting on allowedRegistrationAuthorities - useful for GDPR purposes 
+
+             Absence of allowedRegsitrationAuthorities - no action taken
+             Presence of allowedRegistrationAuthorities - attribute filters to be present in only said RA (one or more)
+            --> 
+           
+            <attribute type="urn:mace:dir:attribute-def:eduPersonUniqueID" store="Active Directory" name="norEduPersonLIN" />
+
+            <!-- Attention! You might need to filter this attribute on SP level before releasing it. -->
+            <attribute type="urn:mace:dir:attribute-def:eduPersonEntitlement" store="Active Directory" name="edupersonentitlement" />
+
+              <!-- Attention! Never send any AssuranceLevel(s) your institution isn't certified for --> 
+              <!-- for definitions, see:  https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0 -->
+            <attribute type="urn:mace:dir:attribute-def:eduPersonAssurance" store="Static">
+            <!-- uncomment if your identity store has specific institutional assurance policy statements. These are arbitrary to show where it is defined.
+
+            <value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al1</value>
+            <value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al2</value>
+            -->
+            <value>https://refeds.org/assurance</value>
+            <value>https://refeds.org/assurance/profile/cappuccino</value>
+            <value>https://refeds.org/assurance/ID/unique</value>
+            <value>https://refeds.org/assurance/ID/eppn-unique-no-reassign</value>
+            <value>https://refeds.org/assurance/IAP/low</value>
+           <!-- uncomment if your identity store satisfies the statements <value>https://refeds.org/assurance/IAP/medium</value> -->
+            <value>https://refeds.org/assurance/IAP/local-enterprise</value>
+            <!-- uncomment if used, will be sent for all records  <value>https://refeds.org/assurance/ATP/ePA-1m</value> -->
+            <!--uncomment if used, will be sent for all records  <value>https://refeds.org/assurance/ATP/ePA-1d</value>-->
+            </attribute>
+            
+
+
+        <attribute type="urn:oasis:names:tc:SAML:attribute:pairwise-id" store="Active Directory" name="norEduPersonLIN">
+            <transformvalue adfstkstorefunction="pairwiseid" />
+        </attribute>
+
+        <attribute type="urn:oasis:names:tc:SAML:attribute:subject-id" store="Active Directory" name="samaccountname">
+            <transformvalue adfstkstorefunction="subjectid" />
+        </attribute>
+
+            <attribute type="http://schemas.xmlsoap.org/claims/samaccountname" store="Active Directory" name="samaccountname" />
+            <attribute type="http://schemas.xmlsoap.org/claims/Group" store="Active Directory" name="tokenGroups" />
+        </attributes>  
+</configuration>
diff --git a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml
new file mode 100644
index 0000000..c73420b
--- /dev/null
+++ b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml
@@ -0,0 +1,164 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+	<ConfigVersion>1.4</ConfigVersion>
+	<SPHashFile>SPHash.xml</SPHashFile>
+	<MetadataCacheFile>metadata.cached.xml</MetadataCacheFile>
+	<LocalRelyingPartyFile>get-ADFSTkLocalManualSPSettings.ps1</LocalRelyingPartyFile>
+	<MetadataPrefix>EDUID-LU-INTL-SP</MetadataPrefix>
+
+	<MetadataPrefixSeparator>:</MetadataPrefixSeparator>
+	<eduPersonPrincipalNameRessignable/>
+	<Logging useEventLog="true">
+		<LogName>ADFSToolkit</LogName>
+		<Source>Import-ADFSTkMetadata</Source>
+	</Logging>   
+	<metadataURL>https://eduid.lu/metadata/edugain-sp.xml</metadataURL>
+    <signCertFingerprint>B8EC5AEFEA01767EF08DC26600769EB328910B97</signCertFingerprint>
+	<claimsProviders>
+		<claimsProvider>Active Directory</claimsProvider>
+	</claimsProviders>
+	<staticValues>
+		<o/>
+		<co/>		
+		<c/>
+		<schacHomeOrganization/>
+		<norEduOrgAcronym/>
+		<schacHomeOrganizationType>urn:schac:homeOrganizationType:eu:educationInstitution</schacHomeOrganizationType>
+		<!-- This value is for EU higher education institution, other allowed values are:
+			urn:schac:homeOrganizationType:eu:educationInstitution
+			urn:schac:homeOrganizationType:int:NREN
+			urn:schac:homeOrganizationType:int:universityHospital
+			urn:schac:homeOrganizationType:int:NRENAffiliate
+			urn:schac:homeOrganizationType:int:other
+		-->
+		<ADFSExternalDNS></ADFSExternalDNS>
+	</staticValues>
+    <storeConfig>
+        <stores>
+            <store name="Active Directory" storetype="Active Directory" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="1" />
+            <!--<store name="Custom Store" storetype="Custom Store" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="2" />-->
+           <!-- <store name="SQL" storetype="SQL" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="3">
+                <query>SELECT CONVERT(varchar(10), Id) FROM [LiUDB].[dbo].[EmployeeIdGen] WHERE uid = REPLACE({0}, 'TEST\', '')</query>
+            </store> -->
+      </stores>
+    </storeConfig>
+      <transformRules>
+        <rule name="ADFSTkExtractSubjectUniqueId" originClaim="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" /> 
+      </transformRules>
+        <attributes>
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" store="Active Directory" name="givenname" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" store="Active Directory" name="sn" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname" store="Active Directory" name="displayname" />
+            <attribute type="http://schemas.xmlsoap.org/claims/CommonName" store="Active Directory" name="cn" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" store="Active Directory" name="name" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" store="Active Directory" name="mail" />
+           
+           <!-- eduPersonAffilation and eduPersonScopedAffiliation settings
+                Scenario A. Static assignement with all active users declared 'member' (default)
+                Scenario B. Dynamic assignment based on GroupSID
+                Scenario C. Attribute ssignment based on presence of eduPersonAffiliation in directory
+             
+             Note that EXAMPLE.COM is used where your domain scope is needed for easy search and replace for your domain.
+             This file is a template so commented out examples will NOT be updated
+            
+             
+             -->
+
+             <!-- Scenario A. Static assignment (default, comment out if you enable another technique
+             <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Static" >
+               <value>member</value>
+             </attribute>
+             end Scenario A. Static assignment -->
+
+             <!-- note that in this template this field will be dynamically updated by eduPersonAfilliation above by new-ADFSTkConfiguration baking in the domain
+              <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Static" >
+              </attribute>
+             end Scenario A. Static assignment -->
+
+
+              <!-- Scenario B. Dynamic assignment 
+     <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid">
+                <group name="SID-FOR-FACULTY-GROUP" value="faculty"/>
+                <group name="SID-FOR-STAFF-GROUP" value="staff"/>
+                <group name="SID-FOR-EMPLOYEE-GROUP" value="employee"/>
+                <group name="SID-FOR-STUDENT-GROUP" value="student"/>
+                <group name="SID-FOR-ALUM-GROUP" value="alum"/>
+                <group name="SID-FOR-AFFILIATE-GROUP" value="affiliate"/>
+                <group name="SID-FOR-MEMBER-GROUP" value="member"/>
+                <group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in"/>
+            </attribute>
+      <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" >
+                <group name="SID-FOR-FACULTY-GROUP" value="faculty@EXAMPLE.COM"/>
+                <group name="SID-FOR-STAFF-GROUP" value="staff@EXAMPLE.COM"/>
+                <group name="SID-FOR-EMPLOYEE-GROUP" value="employee@EXAMPLE.COM"/>
+                <group name="SID-FOR-STUDENT-GROUP" value="student@EXAMPLE.COM"/>
+                <group name="SID-FOR-ALUM-GROUP" value="alum@EXAMPLE.COM"/>
+                <group name="SID-FOR-AFFILIATE-GROUP" value="affiliate@EXAMPLE.COM"/>
+                <group name="SID-FOR-MEMBER-GROUP" value="member@EXAMPLE.COM"/>
+                <group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in@EXAMPLE.COM"/>
+        </attribute> 
+               end Scenario B. Dynamic assignment -->
+
+
+           <!-- Scenario C. Attribute assignment-->
+             
+           <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation">
+              <restrictedvalue>faculty</restrictedvalue>
+              <restrictedvalue>staff</restrictedvalue>
+              <restrictedvalue>employee</restrictedvalue>
+              <restrictedvalue>student</restrictedvalue>
+              <restrictedvalue>alum</restrictedvalue>
+              <restrictedvalue>affiliate</restrictedvalue>
+              <restrictedvalue>member</restrictedvalue>
+              <restrictedvalue>library-walk-in</restrictedvalue>
+            </attribute>
+            
+             <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" >
+            </attribute>
+       
+            <!-- end Scenario C. Attribute assignment -->
+
+            <!-- Attribute filter pivoting on allowedRegistrationAuthorities - useful for GDPR purposes 
+
+             Absence of allowedRegsitrationAuthorities - no action taken
+             Presence of allowedRegistrationAuthorities - attribute filters to be present in only said RA (one or more)
+            --> 
+           
+            <attribute type="urn:mace:dir:attribute-def:eduPersonUniqueID" store="Active Directory" name="norEduPersonLIN" />
+
+            <!-- Attention! You might need to filter this attribute on SP level before releasing it. -->
+            <attribute type="urn:mace:dir:attribute-def:eduPersonEntitlement" store="Active Directory" name="edupersonentitlement" />
+
+              <!-- Attention! Never send any AssuranceLevel(s) your institution isn't certified for --> 
+              <!-- for definitions, see:  https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0 -->
+            <attribute type="urn:mace:dir:attribute-def:eduPersonAssurance" store="Static">
+            <!-- uncomment if your identity store has specific institutional assurance policy statements. These are arbitrary to show where it is defined.
+
+            <value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al1</value>
+            <value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al2</value>
+            -->
+            <value>https://refeds.org/assurance</value>
+            <value>https://refeds.org/assurance/profile/cappuccino</value>
+            <value>https://refeds.org/assurance/ID/unique</value>
+            <value>https://refeds.org/assurance/ID/eppn-unique-no-reassign</value>
+            <value>https://refeds.org/assurance/IAP/low</value>
+           <!-- uncomment if your identity store satisfies the statements <value>https://refeds.org/assurance/IAP/medium</value> -->
+            <value>https://refeds.org/assurance/IAP/local-enterprise</value>
+            <!-- uncomment if used, will be sent for all records  <value>https://refeds.org/assurance/ATP/ePA-1m</value> -->
+            <!--uncomment if used, will be sent for all records  <value>https://refeds.org/assurance/ATP/ePA-1d</value>-->
+            </attribute>
+            
+
+
+        <attribute type="urn:oasis:names:tc:SAML:attribute:pairwise-id" store="Active Directory" name="norEduPersonLIN">
+            <transformvalue adfstkstorefunction="pairwiseid" />
+        </attribute>
+
+        <attribute type="urn:oasis:names:tc:SAML:attribute:subject-id" store="Active Directory" name="samaccountname">
+            <transformvalue adfstkstorefunction="subjectid" />
+        </attribute>
+
+            <attribute type="http://schemas.xmlsoap.org/claims/samaccountname" store="Active Directory" name="samaccountname" />
+            <attribute type="http://schemas.xmlsoap.org/claims/Group" store="Active Directory" name="tokenGroups" />
+        </attributes>  
+</configuration>
diff --git a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml
new file mode 100644
index 0000000..2e013d3
--- /dev/null
+++ b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml
@@ -0,0 +1,167 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+    <ConfigVersion>1.4</ConfigVersion>
+    <SPHashFile>SPHash.xml</SPHashFile>
+    <MetadataCacheFile>metadata.cached.xml</MetadataCacheFile>
+    <LocalRelyingPartyFile>get-ADFSTkLocalManualSPSettings.ps1</LocalRelyingPartyFile>
+
+    <MetadataPrefix>EDUID-LU</MetadataPrefix>
+    <MetadataPrefixSeparator>:</MetadataPrefixSeparator>
+
+    <eduPersonPrincipalNameRessignable>false</eduPersonPrincipalNameRessignable>
+
+    <Logging useEventLog="true">
+      <LogName>ADFSToolkit</LogName>
+      <Source>Import-ADFSTkMetadata</Source>
+    </Logging>   
+
+    <metadataURL>https://eduid.lu/metadata/upstream.xml</metadataURL> 
+    <signCertFingerprint>B8EC5AEFEA01767EF08DC26600769EB328910B97</signCertFingerprint>
+	  <claimsProviders>
+        <claimsProvider>Active Directory</claimsProvider>
+    </claimsProviders>
+    <staticValues>
+		<o></o>
+        <co>Luxembourg</co>		
+        <c>LU</c>
+		<schacHomeOrganization></schacHomeOrganization>
+		<norEduOrgAcronym></norEduOrgAcronym>
+		<schacHomeOrganizationType>urn:schac:homeOrganizationType:eu:educationInstitution</schacHomeOrganizationType>
+		<!-- This value is for EU higher education institution, other allowed values are:
+			urn:schac:homeOrganizationType:eu:educationInstitution
+			urn:schac:homeOrganizationType:int:NREN
+			urn:schac:homeOrganizationType:int:universityHospital
+			urn:schac:homeOrganizationType:int:NRENAffiliate
+			urn:schac:homeOrganizationType:int:other
+		-->
+		<ADFSExternalDNS></ADFSExternalDNS>
+	</staticValues>
+    <storeConfig>
+        <stores>
+            <store name="Active Directory" storetype="Active Directory" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="1" />
+            <!--<store name="Custom Store" storetype="Custom Store" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="2" />-->
+           <!-- <store name="SQL" storetype="SQL" issuer="AD AUTHORITY" type="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname" order="3">
+                <query>SELECT CONVERT(varchar(10), Id) FROM [LiUDB].[dbo].[EmployeeIdGen] WHERE uid = REPLACE({0}, 'TEST\', '')</query>
+            </store> -->
+      </stores>
+    </storeConfig>
+      <transformRules>
+        <rule name="ADFSTkExtractSubjectUniqueId" originClaim="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" /> 
+      </transformRules>
+        <attributes>
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" store="Active Directory" name="givenname" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" store="Active Directory" name="sn" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/displayname" store="Active Directory" name="displayname" />
+            <attribute type="http://schemas.xmlsoap.org/claims/CommonName" store="Active Directory" name="cn" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" store="Active Directory" name="name" />
+            <attribute type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" store="Active Directory" name="mail" />
+           
+           <!-- eduPersonAffilation and eduPersonScopedAffiliation settings
+                Scenario A. Static assignement with all active users declared 'member' (default)
+                Scenario B. Dynamic assignment based on GroupSID
+                Scenario C. Attribute ssignment based on presence of eduPersonAffiliation in directory
+             
+             Note that EXAMPLE.COM is used where your domain scope is needed for easy search and replace for your domain.
+             This file is a template so commented out examples will NOT be updated
+            
+             
+             -->
+
+             <!-- Scenario A. Static assignment (default, comment out if you enable another technique
+             <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Static" >
+               <value>member</value>
+             </attribute>
+             end Scenario A. Static assignment -->
+
+             <!-- note that in this template this field will be dynamically updated by eduPersonAfilliation above by new-ADFSTkConfiguration baking in the domain
+              <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Static" >
+              </attribute>
+             end Scenario A. Static assignment -->
+
+
+              <!-- Scenario B. Dynamic assignment 
+     <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid">
+                <group name="SID-FOR-FACULTY-GROUP" value="faculty"/>
+                <group name="SID-FOR-STAFF-GROUP" value="staff"/>
+                <group name="SID-FOR-EMPLOYEE-GROUP" value="employee"/>
+                <group name="SID-FOR-STUDENT-GROUP" value="student"/>
+                <group name="SID-FOR-ALUM-GROUP" value="alum"/>
+                <group name="SID-FOR-AFFILIATE-GROUP" value="affiliate"/>
+                <group name="SID-FOR-MEMBER-GROUP" value="member"/>
+                <group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in"/>
+            </attribute>
+      <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" useGroups="true" claimOrigin="http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" >
+                <group name="SID-FOR-FACULTY-GROUP" value="faculty@EXAMPLE.COM"/>
+                <group name="SID-FOR-STAFF-GROUP" value="staff@EXAMPLE.COM"/>
+                <group name="SID-FOR-EMPLOYEE-GROUP" value="employee@EXAMPLE.COM"/>
+                <group name="SID-FOR-STUDENT-GROUP" value="student@EXAMPLE.COM"/>
+                <group name="SID-FOR-ALUM-GROUP" value="alum@EXAMPLE.COM"/>
+                <group name="SID-FOR-AFFILIATE-GROUP" value="affiliate@EXAMPLE.COM"/>
+                <group name="SID-FOR-MEMBER-GROUP" value="member@EXAMPLE.COM"/>
+                <group name="SID-FOR-LIBRARYWALKIN-GROUP" value="library-walk-in@EXAMPLE.COM"/>
+        </attribute> 
+               end Scenario B. Dynamic assignment -->
+
+
+           <!-- Scenario C. Attribute assignment-->
+             
+           <attribute type="urn:mace:dir:attribute-def:eduPersonAffiliation" store="Active Directory" name="eduPersonAffiliation">
+              <restrictedvalue>faculty</restrictedvalue>
+              <restrictedvalue>staff</restrictedvalue>
+              <restrictedvalue>employee</restrictedvalue>
+              <restrictedvalue>student</restrictedvalue>
+              <restrictedvalue>alum</restrictedvalue>
+              <restrictedvalue>affiliate</restrictedvalue>
+              <restrictedvalue>member</restrictedvalue>
+              <restrictedvalue>library-walk-in</restrictedvalue>
+            </attribute>
+            
+             <attribute type="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" store="Active Directory" name="eduPersonScopedAffiliation" >
+            </attribute>
+       
+            <!-- end Scenario C. Attribute assignment -->
+
+            <!-- Attribute filter pivoting on allowedRegistrationAuthorities - useful for GDPR purposes 
+
+             Absence of allowedRegsitrationAuthorities - no action taken
+             Presence of allowedRegistrationAuthorities - attribute filters to be present in only said RA (one or more)
+            --> 
+           
+            <attribute type="urn:mace:dir:attribute-def:eduPersonUniqueID" store="Active Directory" name="norEduPersonLIN" />
+
+            <!-- Attention! You might need to filter this attribute on SP level before releasing it. -->
+            <attribute type="urn:mace:dir:attribute-def:eduPersonEntitlement" store="Active Directory" name="edupersonentitlement" />
+
+              <!-- Attention! Never send any AssuranceLevel(s) your institution isn't certified for --> 
+              <!-- for definitions, see:  https://wiki.refeds.org/display/ASS/REFEDS+Assurance+Framework+ver+1.0 -->
+            <attribute type="urn:mace:dir:attribute-def:eduPersonAssurance" store="Static">
+            <!-- uncomment if your identity store has specific institutional assurance policy statements. These are arbitrary to show where it is defined.
+
+            <value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al1</value>
+            <value>http://yourInstitutionalDomainSpecificPolicy.ca/policy/assurance/al2</value>
+            -->
+            <value>https://refeds.org/assurance</value>
+            <value>https://refeds.org/assurance/profile/cappuccino</value>
+            <value>https://refeds.org/assurance/ID/unique</value>
+            <value>https://refeds.org/assurance/ID/eppn-unique-no-reassign</value>
+            <value>https://refeds.org/assurance/IAP/low</value>
+           <!-- uncomment if your identity store satisfies the statements <value>https://refeds.org/assurance/IAP/medium</value> -->
+            <value>https://refeds.org/assurance/IAP/local-enterprise</value>
+            <!-- uncomment if used, will be sent for all records  <value>https://refeds.org/assurance/ATP/ePA-1m</value> -->
+            <!--uncomment if used, will be sent for all records  <value>https://refeds.org/assurance/ATP/ePA-1d</value>-->
+            </attribute>
+            
+
+
+        <attribute type="urn:oasis:names:tc:SAML:attribute:pairwise-id" store="Active Directory" name="norEduPersonLIN">
+            <transformvalue adfstkstorefunction="pairwiseid" />
+        </attribute>
+
+        <attribute type="urn:oasis:names:tc:SAML:attribute:subject-id" store="Active Directory" name="samaccountname">
+            <transformvalue adfstkstorefunction="subjectid" />
+        </attribute>
+
+            <attribute type="http://schemas.xmlsoap.org/claims/samaccountname" store="Active Directory" name="samaccountname" />
+            <attribute type="http://schemas.xmlsoap.org/claims/Group" store="Active Directory" name="tokenGroups" />
+        </attributes>  
+</configuration>

From b37fff10e45913077ffcb88ff21e68e1287e621d Mon Sep 17 00:00:00 2001
From: Stefan Winter <stefan.winter@restena.lu>
Date: Wed, 11 Dec 2024 16:15:01 +0100
Subject: [PATCH 2/2] SHA-256 hashes

---
 .../federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml | 2 +-
 .../federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml  | 2 +-
 .../config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
index 34b019c..7a98460 100644
--- a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
+++ b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-IDP_defaultConfigFile.xml
@@ -16,7 +16,7 @@
     </Logging>   
 
     <metadataURL>https://eduid.lu/metadata/edugain-idp.xml</metadataURL> 
-    <signCertFingerprint>B8EC5AEFEA01767EF08DC26600769EB328910B97</signCertFingerprint>
+    <signCertFingerprint>5514E73B917DE18CFDA293297EBA737713B98A3418BF029E3EAF300916CDDFFA</signCertFingerprint>
 	  <claimsProviders>
         <claimsProvider>Active Directory</claimsProvider>
     </claimsProviders>
diff --git a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml
index c73420b..f2ce556 100644
--- a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml
+++ b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU-INTL-SP_defaultConfigFile.xml
@@ -13,7 +13,7 @@
 		<Source>Import-ADFSTkMetadata</Source>
 	</Logging>   
 	<metadataURL>https://eduid.lu/metadata/edugain-sp.xml</metadataURL>
-    <signCertFingerprint>B8EC5AEFEA01767EF08DC26600769EB328910B97</signCertFingerprint>
+    <signCertFingerprint>5514E73B917DE18CFDA293297EBA737713B98A3418BF029E3EAF300916CDDFFA</signCertFingerprint>
 	<claimsProviders>
 		<claimsProvider>Active Directory</claimsProvider>
 	</claimsProviders>
diff --git a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml
index 2e013d3..7b02b67 100644
--- a/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml
+++ b/ADFSToolkit/config/federation/EDUID-LU/EDUID-LU_defaultConfigFile.xml
@@ -16,7 +16,7 @@
     </Logging>   
 
     <metadataURL>https://eduid.lu/metadata/upstream.xml</metadataURL> 
-    <signCertFingerprint>B8EC5AEFEA01767EF08DC26600769EB328910B97</signCertFingerprint>
+    <signCertFingerprint>5514E73B917DE18CFDA293297EBA737713B98A3418BF029E3EAF300916CDDFFA</signCertFingerprint>
 	  <claimsProviders>
         <claimsProvider>Active Directory</claimsProvider>
     </claimsProviders>