Multiple Application on the same SP with different AttributeConsumingService requirements

[Peter Schober]

* Parlato Paolo <p.parlato at vitrociset.it> [2012-04-26 11:31]:
> I've some applications (with apache https server as reverse Proxy,
> with only one Shibboleth SP) that need different sets of attributes.
> I read that can be used, in this case, the AttributeConsumingService
> configuration parameter.

The AttributeConsumingService element in SAML2.0 metadata can be used
to signal attribute requirements to the IDP, yes. But do you know for
sure that the IdPs you need to federate with will actually be able to
process these and act accordingly? Currently this is highly doubtful,
doubly so for multiple AttributeConsumingService elements/differing
sets of attributes.

> <Handler type="MetadataGenerator" Location="/Metadata" signing="false">
> <md:AttributeConsumingService index="1" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
> <md:ServiceName xml:lang="it">Service 1</md:ServiceName>
> <md:RequestedAttribute FriendlyName="Attribute1" Name="Attr1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute>
> </md:AttributeConsumingService>
> <md:AttributeConsumingService index="2" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
> <md:ServiceName xml:lang="it">Service 2</md:ServiceName>
> <md:RequestedAttribute FriendlyName="Attribute2" Name="Attr2" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"></md:RequestedAttribute>
> </md:AttributeConsumingService>
> </Handler>

How is that any better than generating the metadata by hand, in the
exact way you want it? The SP doesn't use its own metadata and what
you give to others is fully under your control.

> Is there some kind of verification of attribute presence at the SP
> side when the user try to access /App1 or /App2?

Yes, it's called authorization ;)

 AuthType shibboleth
 ShibRequireSession 1
 require $attribute $value(s)

cheers,
-peter