"what metadata are you using"

[Brent Putman]

On 5/28/14 10:34 AM, Ian Young wrote:
>
> Another thing that struck me about the SP is that it already has a lot of private endpoints and an IP access mechanism to protect them. I don't think we have that in the CDS or IdP yet, do we?


More generally, for things like admin/mgmt/monitoring endpoints in the
IdP: I thought about this at some point  on v2.  It occurred to me that
since the IdP is an SSO system, we ought to be able to authenticate
non-profile requests into it using usernames and credentials, i.e using
something better than IP address.  We have all the components already
there.  In v2 I once started a plugin to do something like this using
the AuthnEngine, but I think the need went away and I never finished
it.  But maybe it's something that could be done in v3, especially since
SWF should make it easier to stich things together.

Basically I'm thinking of just something (a top-level flow?) that sends
the user through an existing authN (sub)flow, and then just stores the
authenticated state in the Java session.  In other words, very similar
to what pretty much every web app does to authenticate users.  So keep
as simple as possible.