Coupling permissions to an affiliation

It is typical that an Applicant has the Entitlement only as long as they are affiliated with their home organisation and if they depart (or change role e.g. from faculty to alumn) their Entitlement must be invalidated. REMS does not necessary learn this (and cannot close the Entitlement) but the external service consuming REMS entitlements to enforce them can. This is typically done by requiring the user to log in with their home organisation to the external service which checks the user has still the required affiliation e.g. eduPersonScopedAffiliation=faculty@helsinki.fi. However, it requires that REMS is able to attach this information to each Entitlement.

So the feature request is that REMS records the Applicant's eduPersonScopedAffiliation attribute value when they submit the Application (and Application Member's eduPersonScopedAffiliation attribute value when they accept the Licence), couple this information to their Entitlement and export it together with the Entitlements.

It can be assumed that, when the Applicant or Application Member logs in to REMS, the eduPersonScopedAffiliation is single-valued (if a user has multiple values, the Identity Provider has mechanisms to select one which is exposed to REMS).