[JIRA] Updated: (SSPCPP-245) Support for attribute requirements in the SP

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-245?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SSPCPP-245:
--------------------------------

           Component/s: Request Processing
                        Error Handling
                        Configuration
    Remaining Estimate: 2 weeks
     Original Estimate: 2 weeks

Hijacking this issue to cover feature additions in the area of "validation" of IdP sessions for use by an application, with associated error handling. We need to dump the "boarding" idea and move to a model where any trusted IdP can be selected, and we deal with attribute release after the fact.

I don't think we should try and link this to the metadata problem. It's much simpler to express requirements in their "processed" form, i.e. I want a header named "foo" and I don't care how many different SAML attributes might end up satisfying foo. That's going to be hours and hours less work, and much easier for deployers.

> Support for attribute requirements in the SP
> --------------------------------------------
>
>                 Key: SSPCPP-245
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-245
>             Project: Shibboleth SP - C++
>          Issue Type: New Feature
>          Components: Configuration, Error Handling, Request Processing
>            Reporter: Leif Johansson
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 2.5
>
>   Original Estimate: 2 weeks
>  Remaining Estimate: 2 weeks
>
> Evaluating attribute requirements for applications is something most applications have to do and it would be great to be able to delegate it to the SP. 
> Here is how I think about how this would work: The SP (either in shibboleth2.xml and/or in web server configuration directives) lists required and optional attributes (future versions could support more complex models based on xacml). Before passing the request up to the application the SP would check that the required attributes are available. If they are not available then the SP displays a message (based on a template) showing the missing attributes. The SP admin can then modify this template to include information about how the user/idp admin should go about fixing the problem.
> Finally the SP should include attribute requirements in Metadata and this is the only reason for including the optional attributes which should probably not be checked by the SP.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira