CAS Protocol Milestone

[Cantor, Scott]

On 8/15/14, 3:00 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:
>
>That's fine as long as there is some facility to allow for a verified
>identity. I'm leaning toward a CAS-specific metadata registry since it
>could be used for other cases like relying party context info on the
>UI or principal attribute selection.

Sure, I'm not worried about that case, that's understood to work. Note
that I would still strongly suggest that if you're going to
whitelist/register/whatever, you just adopt the same EntityDescriptor data
model we have. Because a) it works for any SSO protocol I've ever seen, b)
it's the way the API works in any case, and c) it decouples your
application URLs from system names for policy.

(Whatever my opinions about formats, that model doesn't assume XML
metadata either, it's just the API.)

>Agree. One wrinkle is that I can't imagine a CAS profile configuration
>that's analogous to existing SAML profiles, but that's probably more a
>matter of my ignorance that a real obstacle. I'll do some code review
>and try to sketch out a plan.

I just don't know what profile options, if any, might exist. Perhaps none.
In SAML, you have everything from whether to include attributes to
signing/encryption settings, to the name of the IdP, to low level bits
like whether to include particular SAML content.

>Will keep that option in mind, but as I said above I think a durable
>metadata repository containing relying parties is the way to go.

Yes, I meant in the case that we wanted to preserve the ability to do
per-RP settings but not have a registry. If it turns out there are no
per-RP settings, then it's moot.

-- Scott