supporting IdP-initiated SSO only

[Ian Young]

On 16 Mar 2013, at 20:08, Tom Scavo <trscavo at gmail.com> wrote:

> Well, if the metadata spec permitted zero SingleSignOnService
> endpoints (as it should), a discovery service would only expose those
> IdPs with at least one such endpoint.

Well, if the spec said something other than it does, sure.  Whether the spec "should" say something different is moot; it doesn't.

I think the chances of the spec ever changing to allow such a thing are slim to zero, as it isn't a forwards-compatible change: an IDPSSODescriptor lacking a SingleSignOnService would be schema-invalid under the existing specification, and there are existing deployments which check for schema validity.

> I doubt the Shib CDS and EDS do this. They certainly don't have to.

They don't have to support schema-invalid metadata in general; that's not even a well-formed statement.  Whether they actually care about this case, I can't tell you offhand.

I would expect (without checking, but Rod could tell you) that they would both only make visible those IdPs whose SSO endpoint *bindings* are ones they recognise.  The CDS, for example, will only show IdPs with Shib 1 and appropriate SAML 2.0 bindings.

Which is not to say I'd encourage you to put non-standardised binding values in metadata to address this use case; I wouldn't (and my validator rejects such).  But standardising a "don't call me, I'll call you" (non-)binding (non-)value might be an approach.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130316/0efd46ae/attachment.bin