Configuration of IdP with Delegation extension

[Karla Borecky]

Thanks, Scott. I certainly don't want to have to generate different
metadata for different SPs - I just didn't know if adding the
delegation to all of the SAML2SSO occurrences would *break* anything.
If adding that won't confuse my existing SP clients (so to speak)
then... I'm willing to go for it.

So...since changes like this go in the handler.xml file, they are
going to affect every SP - unless you generated/edited a metadata file
specially for some SP's - is that right? It's not like in relying
party or attribute-filter where each SP has its own area.

On Fri, Apr 13, 2012 at 1:19 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 4/13/12 1:02 PM, "Karla Borecky" <kborecky at smith.edu> wrote:
>>
>>This concerned me. How does this affect all of the SPs I am talking to
>>now that *aren't* delegation-aware?
>
> I'm not aware that has any effect at all, but I suppose it's just a
> question of not wanting to introduce unneeded code into existing
> transactions.
>
>>This implies that delegation might now has its own profile - yay - but
>>this change is not reflected in the README file on how to configure
>>the IdP.
>
> It's implied. If you don't want to convert the existing handlers, then you
> add the new one, give it a dedicated profile path, and then make sure that
> the SSO service in the metadata you hand out reflects which one you expect
> the recipient of the metadata to use.
>
> It's kind of a giant hassle to be creating special metadata for different
> SPs, so honestly, I don't think it makes sense to do it. The security
> controls are explicitly based on enabling use of the delegation feature by
> particular RPs. You don't get security by just hiding the fact that the
> second endpoint happens to be there, so it really is just a question of
> comfort level running the subclass for everybody, or not.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063