SAML artifact config support
Cantor, Scott
cantor.2 at osu.edu
Tue Dec 17 13:31:42 EST 2013
Related to my reviewing all the profile config code, I've been looking at
the way we're configuring SAML artifact support in the old code.
Right now, the SAML profile config base class/interface has a single
property related to artifacts, just the type to use.
That leads to some oddness because we can't obtain specialized information
needed for some artifact types, primarily the URL of the lookup service at
the IdP, or in the SAML 2 case, the endpoint index in metadata for that
URL. This is the primary case today where the IdP violates my rule of thou
shalt not rely on one's own metadata for behavior.
I reviewed the bulk of the artifact encoding logic in opensaml, old and
new, and I think Brent already added some methods to the message context
subclass that exposes extended information about artifact usage to the
encoder.
So to populate that, my suggestion is that we create a full interface for
this, SAMLArtifactConfig, to carry whatever is needed, and hang that off
SAMLProfileConfig, in place of the existing single artifactType property.
I just don't want to keep adding artifact properties to the top level
interface, I'd rather have that encapsulated.
We don't have to complicate the relying-party schema much, the Spring
parser can take care of constructing the right objects. (To an earlier
point from Rod, at the moment, recall that profile configs aren't native
Spring, and won't be as long as we're maintaining the relying-party config
format.)
One question I had, Rod, did you ever manage to get a property replacement
to work with a custom config schema?
-- Scott
More information about the dev
mailing list