CAS Protocol Milestone

[Marvin Addison]

> What I would *like* to do is treat CAS the same way and consider a request
> with no underlying registry, whitelist, metadata, call it what you like,
> to be unverified, and thus "Anonymous".

That's fine as long as there is some facility to allow for a verified
identity. I'm leaning toward a CAS-specific metadata registry since it
could be used for other cases like relying party context info on the
UI or principal attribute selection.

> One definite downside of doing
> that is that it means the CAS profile configuration object is only going
> to be the one attached to the Anonymous relying party. It didn't sound
> like that was necessarily a big problem.

Agree. One wrinkle is that I can't imagine a CAS profile configuration
that's analogous to existing SAML profiles, but that's probably more a
matter of my ignorance that a real obstacle. I'll do some code review
and try to sketch out a plan.

> The last point I'd make is that there's actually another really simple way
> to forcible "verify" CAS requesters such that they become non-anonymous. A
> metadata resolver plugin could be written that just gins up fake metadata
> objects on demand for any CAS requester, and essentially convinces the
> downstream code that a real registry exists.

Will keep that option in mind, but as I said above I think a durable
metadata repository containing relying parties is the way to go.

M