Generalize RP Selection Mechanism

[Marvin Addison]

The RP/profile configuration machinery has really hit me over the head, but
I finally got a mental model and working implementation in CAS. I chose to
model CAS proxy trust configuration
as ProfileConfiguration->SecurityConfiguration->ClientTLSValidationConfiguration
since it's conceptually the same thing except with roles reversed: the IdP
connects to a remote endpoint over HTTPS. Since this configuration is
deployer-specific, there's no default configuration that can be applied to
the default relying party. So I need a way to do something like
RelyingPartyByGroup with the CAS protocol. I have a plan to make that work
by leveraging RelyingPartyContext#relyingPartyIdContextTree, but that is
very much CAS protocol-specific and less natural than I'd like. Ideally the
notion of "group" would be protocol agnostic and I could
use RelyingPartyByGroup as is. That's not possible at present since the
notion of group is tightly coupled to SAML metadata.

I would like to propose making group a first-order relying party concern
(e.g. RelyingPartyContext#group) so that it can be configured in a
protocol-specific fashion, leaving group activation to be a simple
selection on some attribute of RelyingPartyContext. Does that make sense?

Best,
M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141113/188f3d05/attachment.html