Simple Internal Federation Example?

[Todd Piket]

All good points Peter.  I use the term "internal federation" to suggest that this is for internal use only and is unlikely to be joined with any other federation like InCommon.  The simple federation I'm getting at is a single IdP with one or more SPs.  The IdP would have a specific attribute release policy for one or more of the SPs.  Preferably releasing attributes from an LDAP server.  I think the SP/IdP part isn't what I'm struggling with, but the attribute release policy and filter setup.  I'll keep cruising the wiki as well.  Maybe something will click eventually.

Also, I do see that the default config is mostly usable, but I find that modifying it is far less intuitive than it used to be and I don't seem to be connecting the dots using the information provided on the wiki.  Perhaps it is more difficult to boot strap a 2.x setup when you're previous experience is with 1.3?  I don't know, but I built the 1.3 instance in about a day, but the 2.x instance isn't going as well.

Thanks for your help.


Regards,

Todd Piket
Middleware Technical Architect

"We would accomplish many more things if we did not think of them as impossible."  -Vince Lombardi







>>> On Tue, Oct 4, 2011 at  9:21 AM, in message
<20111004142140.GY29554 at wssp.cc.univie.ac.at>, Peter Schober
<peter.schober at univie.ac.at> wrote: 
> * Todd Piket <Todd.Piket at csu.mnscu.edu> [2011-10-04 15:51]:
>> Has anybody on this list built a simple, internal Shib 2.x
>> federation?  If so, would you be willing to let me have sanitized
>> XML files for the IdP and SP?
> 
> What is an internal federtation? Several SPs, several IdPs? One IdP?
> How would you expect the metadata describing these entities to differ
> from "non-internal" federations (such as InCommon)?
> With XML files you're referring to the complete configuration? I doubt
> this will help. The default config is almost usable as is, mostly
> removing a couple of comments around elements (e.g. attributes) you'd
> like. And configuration files have nothing to do with "internal
> federation", so I' not sure what you're asking, I guess.
> 
> We have local SPs (not registered with a "paperwork/contract
> federation") that are registered at our central IdP. Is that a local
> federation? Other systems have several campus (as I've been told the
> plural of "campus" is) and hence each may run its own IdP. Even there
> looking at individual IdP or SP config files won't help, I suspect.
> The question there would be how to organize the "federation", which
> what tools, registration practices, metadata signing, etc. (which are
> all more questions about processes than XML snippets).
> -peter
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net