AttributeChecker and redirectErrors

[Cantor, Scott]

On 1/16/13 6:58 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>From that came the desire for handling failed AttributeChecker
>evaluations the same way as Errors/@redirectErrors: with a redirect to
>some external service.
>Seems to me handling all necessary the conditional logic will be quite
>a bit easier in a full prgramming/scripting environment, based on
>request parameters, as compared to nested shibmlpif and shibmlpifnot
>inside the template.
>(Depending on the use there might then be the issue of forwarding PII
>to a third party -- the handling service -- but as of now I don't see
>a case where I needed to include attributes on the subject as part of
>the attribute checker.)
>
>Does that make sense and seems like a useful feature to others?
>(I'd add an issue in Jira then.)

I think my assumption was that if you wanted to do this, it would make
more sense to skip the AttrChecker thing and just install your own
sessionHook that pointed to an application page that did the checking.

That seemed more elegant than trying to decide what to put on a redirect
and how to fit it all.

>While I'm at it: For that idea -- but also for keeping the templates
>for the Attribue Checker generic and identical over installs -- it
>might also be helpful if the AttributeExtractor/@type="Metatdata"
>could also export parts of the SP's own metadata (mdui, contactPerson,
>etc.) in the way it currently does for the IdP.

It's not very easy to do at this point. The logic that does that for the
IdP is very welded into the SSO process and handled very specially right
now.

>  Not sure the latter is really generally helpful (and might even do
>damage, since "the SP never processes its own metadata" would then
>be potentially technically incorrect) and as soon as the
>AttributeExtractor/@type="Metatdata" is involved I have (or the
>deployer has) to touch shibboleth2.xml anway.
>So probably not worth the effort.

I would be very concerned about introducing that dependency also, since
the metadata source of its own metadata would have to an actual metadata
provider, not anything related to the metadata generator, and that strikes
me as even more confusing.

-- Scott