PostAuthenticationFlows for non-SAML profiles

[Misagh Moayyed]

So for displaying, I took a look at the velocity template, and I see it
attempts to pull pieces out of RPUI which of course is
SAMLMetadataContext-relevant. So support for it seems to be there; I just
need to figure out how to inject that info into the context hierarchy to
make it display the same bits. The lookup context strategy looks something
like this:

metadataContextLookupStrategy = Functions.compose(new
ChildContextLookup(SAMLMetadataContext.class), Functions.compose(new
ChildContextLookup(SAMLPeerEntityContext.class), new
OutboundMessageContextLookup()));

Any suggestions as to how I can prepare the profile context to accommodate
that? How would you translate that compose() call? Does it say "looks up
the child context that is of type SAMLMetadataContext, and then look up
its SAMLPeerEntityContext based on the outbound message context of the
profile"? As you can tell, I am very confused :) 

I do agree with Rod that there are complications in figuring out what's
required and what is not in terms of released attributes, but I also think
delegating that decision to the user would be OK. It's possible that
integrations could break because I checked off what is deemed to be a
required attribute, but at least I made the choice to check that off. As a
developer, I would like to make that choice available when possible.

At any rate, I am really not focused on the UI which is really out of
scope for what I am working on, and so is dynamic registration and
registration. This is just a list of general wonderings :) I am sure these
will come up though as we fine tune the flows. 
  

> -----Original Message-----
> From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of David
> Langenberg
> Sent: Friday, August 21, 2015 7:30 AM
> To: Shib Dev <dev at shibboleth.net>
> Subject: Re: PostAuthenticationFlows for non-SAML profiles
> 
> 
> > On Aug 21, 2015, at 8:27 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> >
> > On 8/21/15, 10:20 AM, "dev on behalf of David Langenberg" <dev-
> bounces at shibboleth.net on behalf of davel at uchicago.edu> wrote:
> >>
> >>>
> >>> OTOH, showing maybe just the virtual host might be sensible.
> >>
> >> I still cringe at this (mypersonalapp://process-oauth-response)
> >
> > Certainly in SAML terms, yes, we use the UI metadata as the
abstraction
> for this, and the entityID in the worst case.
> >
> > I don't believe it's appropriate to display any of that sort of
> information if acquired from an untrusted source (and the site itself
> can't be trusted).
> 
> The redirect_url (while provided by the user-agent) is validated against
> OIDC metadata just like a SAML ACS URL.  It's something you can trust.
> 
> Dave
> 
> --
> To unsubscribe from this list send an email to dev-
> unsubscribe at shibboleth.net