Disallow eppn/affiliation to be asserted by the wrong IdP

[William Spooner]

On 11 Oct 2012, at 12:47, Ian Young wrote:

> 
> On 11 Oct 2012, at 12:33, William Spooner <william.spooner at eaglegenomics.com> wrote:
> 
>> I think the penny has dropped! I just need to edit my MetadataProvider XML with the 'correct' IdP scope,
> 
> Depends where you're getting your metadata from.  If you're getting it from a federation, the normal thing you'll find is that each IdP has the scopes permitted to it listed as <Scope> elements in the metadata itself, so there is no need to configure anything in your SP at all.

Two of the IdPs I'm dealing with do not define scope in their metadata. I'm working with local XML documents, so could add manually, but take Peter's point that this adds potential for (potentially insecure) issues on any metadata update.


> 
>> and then read e.g. "emailaddress" with a ScopedAttributeDecoder in attribute-map.xml. Cool!
> 
> Email addresses aren't scoped attributes (because, for example, someone from brown.edu might have a gmail.com address) although I realise the @ used to denote the scope is probably confusing in this regard.  The interesting scoped attributes are eduPersonScopedAffiliation and eduPersonPrincipalName.

I admit I'm trying to bend non-edu IdPs to fit the securely scoped shib eppn/affiliation model. It looks like it _could_ be done, but increasingly feels like a hack. Which is a pity as eppns make much more forgiving REMOTE_USER IDs than persistent_ids. Oh well - back to relying on persistent_id and custom application code. 

Thanks again,

Will