Using Metadata in my App

[Tom Scavo]

On Mon, Mar 25, 2013 at 9:13 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 3/25/13 7:13 PM, "Andy Bennett" <andyjpb at knodium.com> wrote:
>
>>authenticates users to my service via the FastCGI interface. It all
>>works well and I've configured things such that my App is delivered the
>>attributes that it wants when a user logs in. When the first user logs
>>in from a particular IdP the App creates an entry for the user as usual
>>and also an entry for the IdP, currently keyed off of the
>>Shib-Identity-Provider variable.
>
> I would in general strongly discourage you from basing things off of the
> entityID other than things that specifically pertain to SAML processing.
> Those are not really organizational identifiers. They only have meaning in
> the context of the low level exchanges taking place.

+1

It's taken me years to fully understand why Scott consistently gives
this good advice but now I finally understand. When site admins in the
InCommon Federation change the entityID associated with their SAML
deployment, this has a ripple effect, mostly for the worse.

>>I have my Federation supplied metadata in an XML file in
>>/var/run/shibboleth/ When I look in this XML file I see data that I'd
>>like to take advantage off. Specifically, the data in <Organization>
>>such as <OrganizationName>.
>
> I think most federations (but not all) would discourage that, as again,
> that does not reflect anything to do with the user in particular.

We certainly would discourage that in the InCommon Federation. We
would, however, like to "take over" the OrganizationName element and
put some useful information in there (which I proposed recently) but
this is not advised for interoperability reasons. We're still groping
for an alternative.

> To the extent that there is information in the metadata of that nature, it
> would be the UIInfo extension material, but even that is about the IdP,
> not about the user, or the user's "organizations". That may be a common
> case, but it's not the purpose of the information, really.

Agreed. There's nothing in the UIInfo extension in InCommon metadata
that is helpful here.

> It's mostly there to drive discovery UI so the user can select their IdP.
> That doesn't mean they're selecting a home organization (unless they
> happen to be doing that too).

This becomes painfully apparent when an organization wants to deploy a
second IdP. Both IdPs can not have the same mdui:DisplayName, so at
that point it becomes clear that equating mdui:DisplayName with the
organization is logically false.

Tom