<div dir="ltr"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">That's what I meant when I said that naming and locations in SAML are separate things, but I don't think that's true in CAS.<br></blockquote><div><br></div><div>That's correct, identity == location in the CAS protocol.</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
But I would expect that in that kind of scenario, you don't get the luxury of just predefining specific URLs as being valid, it will likely be whole families of URLs that are used.</blockquote><div><br></div><div>Indeed. Somewhere you've got to map URL groups/families to individual logical services. There's no way around that.</div><div><br></div><div>The UI theming case Walter mentioned made it clear that a metadata facility for CAS has some value for specific services that need explicit registration in a metadata</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Well, the mismatch is really the overloading of identity and location. This is a very common thing in systems I didn't design. ;-)<br></blockquote><div><br></div><div>Point taken, but man is it ever a convenient simplification that's good enough in most cases. </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
In terms of endpoint validation, SAML metadata doesn't define that, the SAML protocol does. By which I mean, you could define a profile of metadata such that the Location attribute in an AssertionConsumerService element with a particular Binding was a regex.<br></blockquote><div><br></div><div>Thanks for sketching out a concrete implementation, Scott. Can you clarify what you mean by "define a profile of metadata"? XML schema definition?</div><div><br></div><div>M<a href="mailto:dev-unsubscribe@shibboleth.net" target="_blank"></a><br>
</div><div><br></div></div></div>