Attribute Aggregating System for Shibboleth Based Access Management Federation

In a federation, single sign-on (SSO) for web applications can be achieved by performing authentication at the user´s home organization called identity provider (IdP) and authorization at the service provider (SP). The IdP provides the user´s information to the SP though the attribute exchange and the SP assigns the authorized access level for the user according to the data in the attributes. The SP trusts the attributes sent from the trusted IdP. However, the authorized access level of the user is limited in some circumstance when the trusted IdP cannot provide enough user´s information to the SP. This study develops an attribute aggregating system that integrates user´s information from different IdPs which is operated by different federated domain. Currently, our developed system is implemented in the Japanese academic society federation called Informatics Square.