SP Logout

[Christopher Bongaarts]

On 9/11/2012 4:40 PM, Cantor, Scott wrote:
> On 9/11/12 5:36 PM, "Tom Poage" <tfpoage at ucdavis.edu> wrote:
>>
>> Wondering if it makes sense to place a 'localhost' acl on the
>> MetadataGenerator Handler in the distribution (i.e. as installed) to
>> implicitly discourage people from using it as a provider--similar to the
>> Status handler.
>
> I considered it, but whatever my opinions are, there are some federations
> that use it in their own processes, and ultimately they have a say in that
> sort of decision. I don't think it would be much of an impediment anyway,
> and would probably just result in questions here.

In our experience replacing our locally developed web SSO system with 
Shib across campus (so 200+ new SPs over the course of about a year and 
a half), the #1 deployer FAQ was "I have N virtual hosts and I'm getting 
'no endpoint' errors".

Somewhere buried in my to-do list is to more fully document the 
common-case practice of generating metadata for that use case, but if 
someone else already has such a beast, adding it to the Shib wiki would 
sure be handy. ;)

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%