CAS Service Registry

[Walter Forbes Hoehn (wassa)]

On Apr 9, 2015, at 1:18 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/9/15, 2:02 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:
>> 
>> Hopefully an example will clarify:
>> 
>> 
>>               <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
>>                     c:regex="https://([A-Za-z0-9_-]+\.)*vt\.edu(:\d+)?/.*"
>>                     p:group="standard-vt-services"
>>                     p:authorizedToProxy="false" /> 
>> 
>> That allows all secure services in the VT DNS namespace to use CAS. That is the single most common use of the service registry: to restrict SSO to institutional boundaries.

An entity is simply the default unit to which policy can be applied.  The metadata spec gives a built-in means to easily apply policy in a less granular fashion.  This, of course, can be supplemented by use of extensions to the metadata.  Anything more granular, however, is I think very uncommon and would probably require extensions.

I wouldn’t personally want to implement policy the level you describe, but it seems that it could technically be mapped to a SAML entity.  An entity could just describe “VT Campus Resources,” or somesuch.  So, I guess a question is, when folks implement a policy like the above, would attribute release be implemented at the same granularity?

> A further step would be a more advanced wrapper around the current batch MetadataResolvers that indexes the results by ACS location (which is what the CAS service URL is) and does a lookup against that as well, although given that it's many to many potentially, it's not guaranteed to produce a unique result, but that's more of a deployment consideration.

This describes pretty well what I was thinking.

It seems like it wouldn’t be too difficult to implement a metadata service registry alongside the existing one, but it might make for confusing discussions re: configuration.  The biggest sticking point that comes to mind is that the CAS service parameter is currently being passed to the Attribute Filter, which probably wouldn’t be what one would want if CAS clients were represented as first class entities.

-Walter