Radio buttons instead of a list box in the embedded DS?

[Wessel, Keith]

Yes, whitelisting, but ideally with a different whitelist based on the SP's entityID and the endpoints in metadata, ideally.

I do understand that the eDS wasn't intended to be a centralized service, but the options out there for centralized services are slim with the sunset of the Shibboleth CDS approaching.

Both the EDS and SSP can do good embedded DS work, but they both lack endpoint validation.

I also had suggested to me off list to look at DiscoJuice. I'm not toally sure yet, but I think that it also lacks endpoint validation.

The hacks I was talking about trying to make were to SSP, but at this point, I'l do whatever I have to, I suppose.

Asking all of our SP operators who need a DS to run the EDS is a last resort for me. However, it feels like that's the direction the community's going, so maybe I had better start making an argument to my security folks for doing that.

Keith

-----Original Message-----
From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, June 22, 2016 3:14 PM
To: Shib Dev <dev at shibboleth.net>
Subject: RE: Radio buttons instead of a list box in the embedded DS?

> What was the driver for not doing endpoint validation in the EDS? Lack of
> demand? Complexity? I know it was intended to be embedded into an SP,
> thus reducing the need for it. But if it's not complex, I wonder how easily I
> could add it?

Rod had to ask me, and I don't remember making a conscious decision about it, but I don't think it really would have made sense. It's not a CDS, and the feed it loads is only IdP information.

For the target scenario, a whitelist or the relative URL trick would have made sense, but I don't think it's really practical to do much else.

> I was holding off on hacking the metadata
> loading to pull in discoveryResponse endpoints and on hacking the discovery
> page to check them, but that might also now be an option.

It's not just pulling in a missing piece of data, it's that the EDS doesn't know anything about SPs at all. In effect you'd be generating a whitelist from the metadata, so I think it just needs to be extended to support some kind of whitelisting.

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net