Simple Internal Federation Example?

[Peter Schober]

* Todd Piket <Todd.Piket at csu.mnscu.edu> [2011-10-04 16:49]:
> All good points Peter.  I use the term "internal federation" to
> suggest that this is for internal use only and is unlikely to be
> joined with any other federation like InCommon.  The simple
> federation I'm getting at is a single IdP with one or more SPs.  The
> IdP would have a specific attribute release policy for one or more
> of the SPs.  Preferably releasing attributes from an LDAP server.  I
> think the SP/IdP part isn't what I'm struggling with, but the
> attribute release policy and filter setup.

For the IdP's attribute filter (formerly ARP) I started out with one
rule per SP, later switched to one rule per named metadata file (so I
could just drop an SP's metadata into a metadata file locally known to
the IdP and all attributes would be released for any SP in that file).
I still do use this for a special case but for the most part this has
not been detailed/granular enough (SPs on campus were not as similar
in their requirements as I expected; add a desire for minimum
disclosure to that and you can easily see that this won't work in the
general case).
Currently I have a mix of few rules per-SP (for special cases,
e.g. release one specific entitlement value to one SP) and most of my
rules per-attribute (syntactically they are all the same; what I mean
with per-attribute is that I create an attribute filter policy for
each attribute I release from this IdP and list all SPs that should
recieve that attribute below). Since the IdP knows more SPs than the
number of attributes it handles this scales better in our case. For a
new SP I add the same entity to all desired attributes (i.e., their
attribute filter policiy entries).

> Also, I do see that the default config is mostly usable, but I find
> that modifying it is far less intuitive than it used to be and I
> don't seem to be connecting the dots using the information provided
> on the wiki.  Perhaps it is more difficult to boot strap a 2.x setup
> when you're previous experience is with 1.3?  I don't know, but I
> built the 1.3 instance in about a day, but the 2.x instance isn't
> going as well.

It's been ages since I last configured (and later shutdown) my 1.3
deployment, I simply have no recollection of any of that :)
-peter