Using Metadata in my App

[Cantor, Scott]

On 3/25/13 7:13 PM, "Andy Bennett" <andyjpb at knodium.com> wrote:

>authenticates users to my service via the FastCGI interface. It all
>works well and I've configured things such that my App is delivered the
>attributes that it wants when a user logs in. When the first user logs
>in from a particular IdP the App creates an entry for the user as usual
>and also an entry for the IdP, currently keyed off of the
>Shib-Identity-Provider variable.

I would in general strongly discourage you from basing things off of the
entityID other than things that specifically pertain to SAML processing.
Those are not really organizational identifiers. They only have meaning in
the context of the low level exchanges taking place.

>I have my Federation supplied metadata in an XML file in
>/var/run/shibboleth/ When I look in this XML file I see data that I'd
>like to take advantage off. Specifically, the data in <Organization>
>such as <OrganizationName>.

I think most federations (but not all) would discourage that, as again,
that does not reflect anything to do with the user in particular.

To the extent that there is information in the metadata of that nature, it
would be the UIInfo extension material, but even that is about the IdP,
not about the user, or the user's "organizations". That may be a common
case, but it's not the purpose of the information, really.

It's mostly there to drive discovery UI so the user can select their IdP.
That doesn't mean they're selecting a home organization (unless they
happen to be doing that too).

>From reading Metadata and MetadataForSP it's unclear as to whether the
>Shibboleth software gives me an explicit, non-login-time, interface to
>this metadata or whether I have to find and ingest the file myself.

It does not.

-- Scott