[FEATURE] Add Edugain entity IDs to external IDs

[lizkrznarich]

Describe the problem you would like to solve Several organizations have contacted ROR about the the possibility of adding Edugain IDs to ROR (SLAC, SeamlessAccess, IP Registry). These organizations are typically Service Providers who want to match a ROR ID received an authentication interaction with an IdP to a ROR ID. One example use case from SLAC National Accelerator Laboratory at Stanford:

"In order to effectively pursue this integration we need a linkage to be maintained (likely by ROR) between an ROR entity and an Identity Provider in the a federation associated with eduGAIN or InCommon (using the entityID). Information about eduGAIN can be found at https://edugain.org/. To locate entityIDs for specific organizations you can use https://met.refeds.org/met/search_entities/ and set the Entity Type to IDP and search organization name."

Describe the solution you'd like Add Edugain entity identifiers to ROR records in the external identifiers section.

Who would benefit from this feature? Developers; publishers, funders, and other services who are EduGain services providers; other types of integrators that handle metadata used in SAML authentication/authorization workflows.

Additional information IdPs can be retrieved from the Edugain API https://technical.edugain.org/api.php?action=list_entities&help Example query: https://technical.edugain.org/api.php?action=list_entities&type=idp&format=json

[lizkrznarich]

@adambuttrick has completed an initial reconciliation and found that most Edugain entities have a match (by name and URL) to a ROR record. We have a few questions that require input from community experts, including:

• In the case where a subdivision of a larger organization has a separate entity ID, but the subdivision is not eligible for its own ROR record, should the subdivision's entity ID be included in the parent org's ROR record? (ex, some university libraries have entity IDs, but does not create separate records for libraries that are part of a university).

[skoranda]

I work for the CILogon project at the National Center for Supercomputing Applications (NCSA) at the University of Illinois at Urbana-Champaign (https://ror.org/047426m28). We help research projects use federated identities from eduGAIN for authentication and authorization to research services, portals, and the like. We also operate a user registry for subscriber projects that allows a project to manage their users based on federated identities and do things like put them in groups.

We have now been asked by two subscriber projects, one in the US and on in Australia, if we can automatically link the user record against their organization's ROR based on the login server used to authenticate.

We could very easily do that, and provide a nice benefit to users and their projects, if this feature was added.

I am happy to be contacted for more information and specific use case requirements if it would be helpful.

Thanks for the community work on ROR.

[adambuttrick]

Adding reconciliation file referenced in prior comment: 20230215_edugain_identity_providers_reconciled.xlsx