Anyonymous relying parties

[Cantor, Scott]

On 12/11/13, 11:00 PM, "Sean McHugh" <sean8sean at gmail.com> wrote:
>
>Am I correct here?  Is there documentation or a collection of thoughts on
>other potential security concerns surrounding Anon RPs?

No. It isn't a commonly used feature.

>I'm wondering, has anyone proposed, or does there exist an implementation
>of a whitelist functionality to only enable sending an AuthNResponse to a
>set of
>approved Issuers?  Perhaps sometime of wildcard functionality, etc.

How would you authenticate the Issuer without verifying a signature,
implying you have a key?

If you have keys, you can turn on the option to bypass ACS checks and
reduce that overhead.

>I realize that the answer is probably:  get the metadata for the SP and
>configure it in relying-party.xml  and disable Anonymous RPs ...
>however, the administrative overhead involved in this is a burden for
>smaller shops.

If you want to whitelist, you need a way to collect the data. The format
it's expressed in doesn't really matter, you can script that
transformation.

-- Scott