CAS Protocol Milestone

[Marvin Addison]

> would having (effectively) two metadata types be an issue for mixed mode
> sites?

It could be problematic in the case where a relying party appears in
both SAML and CAS metadata, then the meaning of the relying party in
basic:AttributeRequesterString is ambiguous. I don't see that as a
show stopper since it's likely an edge case, at least for the moment.

> I'm guessing not since CAS would be on-campus and SAML for
> off-campus and never the twain would meet.

I think that's correct at present, but the sub-federation use case Tom
mentioned could increase likelihood in the future. The profile context
together with the relying party provides a unique identifier, but as
far as I know ProfileRequestContext is not used by the attribute
engine. Just thinking out loud: if we needed to disambiguate, we could
prefix CAS relying parties with a namespace prefix. I don't really
like that option, but we have a lot of flexibility in what CAS relying
party IDs look like. I would rather have the ability to filter on
profile ID as well as relying party ID, but I realize that could
require some API changes and may not make sense generally.

M