Shibboleth2 IdP TrustEngine Extension using DANE, is it the right way?

[Ian Young]

On 7 May 2012, at 21:25, Cantor, Scott wrote:

> An EntitiesDescriptor Name isn't a domain, in general, so I don't know how
> wise it would be to want it to be. It isn't even a URI, it's just a
> string. It could be a domain, certainly, and that's a possible convention
> one could use, but it isn't a spec requirement.

One observation would be that @Name is also an optional attribute, and that not all publishers of aggregates use @Name at all.  In the R+E federation space, most do have a @Name and the majority of those use some kind of URL.   The remainder have "urn:…" strings of mixed provenance.

> The problem is that because of DNS' limitations, among other reasons, SAML
> does not use domains as names. Neither here nor in the case of entityIDs.
> Given a URI, you can't in general even map that to a domain unless you
> preclude URNs or assume URNs of a particular sort.

On the entityID side, and again just for the R+E federations, the great majority of entityID values these days are URLs.  A small number of validly delegated "urn:mace:…" patterns cover almost all of the rest.

There are a small number of entities in the R+E federations whose entityIDs are either invalid because they aren't valid absolute URIs, or use "urn:…" names with unregistered NIDs.  Otherwise, it's possible to extract a domain reasonably reliably for most purposes.

	-- Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20120508/78533490/attachment.bin