Alternatives to DS deployment

[Cantor, Scott]

On 6/18/13 4:21 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:

>I¹m not sure I¹m fully grokking the advice here. Are these the kinds of
>alternatives being suggested? Are there other common modes to consider?
>Or is something else implied here?

The embedded version is more recommended at this point, and is much less
hassle to set up with a Shibboleth SP than standing up a whole Java app.

>* link to an existing WAYF/DS (such as InCommon¹s WAYF/Discovery Service)
>rather than deploying locally

No, that is almost universally the wrong choice IMNSHO. That was a failed
idea.

>* present a static list of idp-initiated SSO links

No, you don't need IdP initiated SSO.

>* present a static list of IdPs, then initiate actual authentication
>requests by calling SAML libraries and redirecting the user directly in
>your app (instead of having the SP do this)

No, you make the SP do it.

That's all the EDS is ultimately, a generator of automated links back into
the SessionInitiator with the IdP specified. For a small number of IdPs,
you can do that by hand.

-- Scott