Opinions on SIDP-570?

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2013-02-18 18:21]:
> Basically it's asking us to look into exposing the entityID as the
> "service name" for anonymous SPs for IdPs that are configured to allow
> anonymous SPs.

Which is still pretty bad UI, IMO. Making the string displayed
("Unspecified Service Provider", according to the Jira issue)
configurable might be a "softer" alternaitve.

> My off-the-cuff reaction is, I don't like the idea of displaying
> anything that might be interpreted as "reasonable belief of the IdP"
> about a request when we have no such evidence.

+1 (Though if the IDP wanted to expose itself to that threat it
could/should add supporting text to the UI, e.g. "claims to be ...").

Anyway, the entityId is already available to the JSP, as documented:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPassLoginPage#IdPAuthUserPassLoginPage-LoginContext
It may be inconvenient to access it that way, but checking for taglib
values and falling back to loginContext.getRelyingPartyId() should be
trivial for anyone wanting to rely on that info.

> OTOH, since we don't generally require signed requests from the SPs
> we do know, that doesn't exactly scream consistency.

The request may be forged, impersonating an existing SP, but as the
response can't be "stolen" by the forged RP (because of known ACS
URLs) I'd say that's forgivable (and you can always require signed
requests; using the patch available in Jira we did this for a while to
replace ACS URL checking for a specific RP which insisted on dynamic
-- as in per request -- ACS values).
-peter