CAS Service Registry

[Cantor, Scott]

On 4/9/15, 1:50 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>
>I'm absolutely open to enhancements and extensions. That said, there's a fundamental problem for which I don't see a solution w/r/t an metadata-based implementation. The service registry model provides a one-to-many registry, which is absolutely vital for most CAS deployments, and I don't see how to implement something similar with SAML metadata.

What do you mean by one to many?

>Perhaps where I'm getting hung up on the equivalent model under SAML metadata is using service URLs for entity IDs.

An entityID is never a service URL, it's strictly a name that happens to be a URI. The level of granularity is policy-dependent. A single entity might have many service URLs, though as a matter of policy, it's a bad idea to have many different, unrelated services represented by a single name simply because it dilutes the meaning of the name.

> I suppose we could create an arbitrary identifier that functions like a group name and each entity in that case would be composed of multiple "services", but that's a fundamentally different model than anything I've ever seen. I simply don't know enough about SAML metadata to understand what my options are. I'm open to any solution that supports the one-to-many requirement.

I can suggest something once I understand the problem. I don't know exactly what the service registry is doing, since I was led to understand that the norm in CAS is to apply no controls and not register services at all (which should match the IdP's UnverifiedRP semantic).

-- Scott