Help configuring custom relying party for a relaystate url

[Cantor, Scott]

On 8/20/13 2:33 PM, "Ian Rifkin" <irifkin at brandeis.edu> wrote:
>
>I see one line in my RP config that mentions "anonymous:"
>
> <rp:AnonymousRelyingParty
>provider="https://shibboleth.brandeis.edu/idp/shibboleth"
>defaultSigningCredentialRef="IdPCredential"/>
>
>
>So I guess I have enabled anonymous RP support. Is that something that is
>there by default? RegardlessŠ

No, that disables anonymous support, there are no profiles enabled for it.

>This gets to the heart of my question. Should I be concerned?

You should probably determine why you're mistaken. You do NOT have a
system that would ever respond to an SP without metadata provided, so your
impression that that works is incorrect.

>What do you mean by SPs that "actually use the IdP"? If I didn't release
>an attribute to a particularly anonymous SP's entityID then what would
>happen?

Then it wouldn't be released, but there is no evidence of who an SP is
without metadata, and that's the meaning of anonymous.

>Using the aacli.sh bin to test if I use the anonymous SP's entityID I see
>the attribute I released to them. If I type in jibberish for the
>requester then it just returns "No attribute statement." I guess this is
>why I'm confused -- what will creating metadata
> improve/fix/prevent?

aacli is not a working IdP, it's a testing tool. It does not care about
whether you have metadata or not. If you create a policy for foo and then
tell the tool to test the requester named foo, it will tell you it will
release data for foo. If an SP called itself foo, but no metadata exists
for foo, then no SP could successfully submit a request as foo, and the
policy would never be relevant.

If you're equating aacli's behavior as some evidence of what the IdP will
do, that's probably why you're confused.

-- Scott