Is Shibboleth a match to replace our multi-factor authentication system ?

[Tom Scavo]

On Wed, Sep 12, 2012 at 11:17 AM, Christopher Bongaarts <cab at umn.edu> wrote:
>
> One of the primary benefits for us using Shib for local SSO was to
> eliminate the need for maintaining both halves of the system.

Oh, I didn't know that UofM used shib for SSO. That's good to know :-)

> To reemphasize one point that both Scott and Peter pointed out - if you
> run an IdP for lots of local SPs, you'll need to become very familiar
> with metadata.  When the number of SPs we handled was small, we were
> able to manually add new SPs as they came along by hand to the IdP
> configuration files.  After we hit a certain point in growth, it became
> necessary to automate some of the configuration process.   We now sanity
> check the metadata for well-formedness, automatically generate attribute
> filter fragments with "default" attribute release policies that are
> easily edited, and do version control checkins so we can track history.

I'm curious, are the attribute filter elements targeted at specific
SPs via entityID? Are there groups of SPs with identical attribute
requirements?

>   Other institutions have developed nicer solutions with web interfaces
> for metadata submission and updating, some of whom have mentioned the
> possibility of releasing rough code for general use/adaptation (nudge
> nudge).

Are you referring to Duke or someone else?

FYI, the InCommon Federation Manager is being re-engineered to enable
campuses to manage local federation metadata. (Now you know why I
asked the questions above :) Is this something UofM might be
interested in using?

Thanks Chris.

Tom