Shibboleth without attribute queries and artifact resolution

[Cantor, Scott]

On 12/14/12 2:36 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

>Wondering if anyone else has tried this and what kind of results we might
>expect.

You mean attribute queries, not artifact queries, so I corrected the
subject line.

> 
>As it appears that Terracotta 3.7 no longer has the tim-tomcat-6.0
>integration module, we¹re evaluating other options for our IDP cluster.

Are they supporting newer versions or literally not supporting Tomcat?
That seems extreme.

>But we¹re also considering a more lazy solution. Since we¹ll have a new
>external auth mechanism behind Shib in the coming months, we don¹t want
>to put too much work into something that we¹ll just end up replacing. So,
>we¹re considering just enabling sticky sessions on our SLB, ensureing SSO
>as long as a user doesn¹t happen to hit the IDP after the node they
>already used goes down but before their IDP session would have expired
>and they¹d have to log in again, anyway.

That's a fairly lengthly stick, of course.

> 
>Other than the potential future SLO route, looks like we¹re going to miss
>out on artifact resolution and, unless we implement support for the
>shared secret and CryptTransientIDs, some attribute queries.

That part isn't something you need my extension for, it's built-in now.

>Can I assume that, if our IDP is configured to send all attributes on the
>front channel initially, we don¹t need to support attribute queries based
>on transient ID?

Yes.

> 
>Are there other things I should be thinking about here? Just thought it
>best to ask the community before I shoot myself in the foot.

There seem to be use cases for artifact, but I haven't encountered them,
and even if they were important, I don't think it's more important to me
than not running Terracotta.

As far as queries, really up to you since it's trivial to get it working.

-- Scott