Associating SP users with specific IdPs

[Tom Scavo]

On Sun, Mar 24, 2013 at 3:26 PM, Robert Lowe <robertmlowe at rmlowe.com> wrote:
>
>> > ... since metadata is typically provided by the IdP, doesn't this
>> > amount to the IdP self-asserting what values it's allowed to send?
>>
>> In the InCommon Federation, scope is tightly controlled.
>
> Just curious, what's the process for that? Does the institution submit the
> metadata and InCommon just vets it? Or does InCommon actually modify the
> metadata?

Every federation has a process to vet this piece of metadata (although
I don't claim to know what it is in each case). In the InCommon
Federation, a site administrator logs into a secure web application to
update metadata. The software vets those things that can be automated
while humans check those things that can not. Scope is one of the
latter.

Tom