Proposal to resolve entities by role+protocol

[Cantor, Scott]

On 12/10/15, 1:53 PM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:


>
>I'm just not familiar enough with the SAML metadata model to group CAS services among SAML ones in the same SPSSODescriptor. I don't know offhand if the supportedProtocols attribute takes an xsd:URI or is an enum of known SAML protocols; I guess if it's the former then there's nothing that would forbid mixing them together.

It's a list of protocols, that's it. Mixing them in one role is structurally/functionally fine, just not likely in this context. Having an IdP role include both would be more common (if a CAS client cared) since the IdP now supports all three.

>I think I agree with you, especially if we agree that the best way to model this is with a CAS protocol endpoint modeled as an ACS entry among 0..* SAML ones under a single SPSSODescriptor.

You certainly can do so.

Endpoints are essentially meant to be self-discriminating of the protocol. The protocolSupportEnumeration is up at the top of the role to help sift through roles or entities to find one which should have endpoints you need/support.

-- Scott