|Entitlement othershow all attributes|
|Description||URI (either URL or URN) that indicates a set of rights to specific resources|
|Vocabulary||URIs only, i.e. a URL or URN|
|LDAP Syntax||Directory String|
|# of values||multi|
URI (either URN or URL) that indicates a set of rights to specific resources.
A simple example would be a URL for a contract with a licensed resource provider. When a principal's home institutional directory is allowed to assert such entitlements, the business rules that evaluate a person's attributes to determine eligibility are evaluated there. The target resource provider does not learn characteristics of the person beyond their entitlement.
The trust between the two parties must be established out of band. One check would be for the target resource provider to maintain a list of subscribing institutions. Assertions of entitlement from institutions not on this list would not be honored.
URN values would correspond to a set of rights to resources based on an agreement across the relevant community. MACE (Middleware Architecture Committee for Education) affiliates may opt to register with MACE as a naming authority, enabling them to create their own URN values.
All attribute definitions in a single document: SWITCHaai Attribute Specification