CAS Protocol Milestone

[Cantor, Scott]

On 8/18/14, 11:34 AM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>> would having (effectively) two metadata types be an issue for mixed mode
>> sites?
>
>It could be problematic in the case where a relying party appears in
>both SAML and CAS metadata, then the meaning of the relying party in
>basic:AttributeRequesterString is ambiguous. I don't see that as a
>show stopper since it's likely an edge case, at least for the moment.

It's a precondition for the metadata API that the entityIDs be unique, and
there really is no use case for any overlaps that aren't intentional.

>I would rather have the ability to filter on
>profile ID as well as relying party ID, but I realize that could
>require some API changes and may not make sense generally.

There's a PredicatePolicyRule that can run any predicate against the
profile context. There's also already a predicate for checking whether the
request is Anonymous, so that's already available.

-- Scott