Discovery and protocols

[Tom Scavo]

On Thu, Dec 29, 2011 at 10:34 AM, Rod Widdowson
<rdw at steadingsoftware.com> wrote:
>
> This is specifically triggered by https://issues.shibboleth.net/jira/browse/SDSJ-95
>
> - Does it suffice to just look for the correct endpoint or should one check for "urn:mace:shibboleth:1.0" in the
> protocolSupportEnumeration?  My instinct is that one has to do both.

I don't think you need to do both. The value of
protocolSupportEnumeration may be incorrect but I don't see why that
should stop the DS from doing the right thing. You have to find a
compatible endpoint anyway, so it seems (at first blush) that should
suffice.

> - If an IdP is dropped from the display list because it does not declare itself as supporting the correct protocols, what (if any)
> feedback should be provided (both to the admin and to the end user).  My instinct is that all we can do is log the dropping of the
> IdP (at DEBUG) and that's it.

Seems reasonable.

> Note that none of this is (should be) an issue for the EDS - I believe that an SP can assumed to filter out IdPs with mutually
> different protocols.

Why should the CDS be any different? Is there some assumption that the
CDS has access to IdP metadata only?

Tom