Generalize RP Selection Mechanism

[Marvin Addison]

>
> It's not easier to implement, no, although eventually you can just feed in
> actual metadata for CAS and there's no extra work, but to mock it up is
> more work, yes.


It wasn't too much trouble to implement the fraction of EntityDescriptor
that is required to satisfy my requirements and dangle it off
SAMLMetadataContext:

http://svn.shibboleth.net/view/java-identity-provider?rev=6894&view=rev

I'll verify in situ tomorrow after the nightly idp-distribution drops.


> As an old example:
> https://wiki.shibboleth.net/confluence/display/DEV/OpenIDMetadataProfile


Thanks for sharing that -- it immediately made clear your comment, "eventually
you can just feed in actual metadata for CAS." Unfortunately that's a
non-starter; no institution wants to explicitly register every relying
party within their walls that wants to use "local" SSO. In fact many if not
most institutions want to allow SSO without any explicit registration for
services that originate from their DNS domain. For that reason Jasig CAS
has evolved a simple facility ("service registry") for registering logical
groups of services by regular expressions that define allowed services by
URL. Here at Virginia Tech we register a "catch-all" expression for *.vt.edu,
then handle special cases (e.g. hosted services) in a one-off fashion.

I have reproduced the service registry facility in the IdP [1], which
effectively creates a lightweight CAS-specific metadata facility. This
suggests to me that not all metadata needs can be captured by the SAML
metadata model. I'd like to see at least a thin metadata API that has
extension points that can be met by non-XML metadata. You can see from my
ServiceEntityDescriptor implementation that there are pain points in
extending existing components. In the end what I have done will probably
work, but I think a more general MD API would have produced a cleaner
result and could be generally beneficial to non-SAML protocols.

M <dev-unsubscribe at shibboleth.net>

[1]
http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-cas-impl/src/test/resources/spring/test-flow-beans.xml?revision=6894&view=markup
, cas.serviceRegistry bean
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141113/bc1062f4/attachment.html