Using Metadata in my App

[Andy Bennett]

Hi,

> Scott already commented on the conceptual issues, a few practical
> notes below (if you still want to know about the "what" and "how").

Thanks!


> Here's an example for shibboleth2.xml:
> 
> Add metadataAttributePrefix="idp-" to your ApplicationDefaults element.
> Add a Metadata AttributeExtractor below the other extractors, e.g.:
> 
> <AttributeExtractor type="Metadata" DisplayName="name"
>   Description="desc" InformationURL="infourl" OrganizationURL="orgurl">
>   <Logo id="logo" formatter="$_string"/>
> </AttributeExtractor>
> 
> This will populate idp-name, idp-desc, idp-infourl, idp-orgurl and
> idp-logo iff the referenced data is available in SAML metadata.
> Everything except orgurl refers to the MDUI metadata extensions
> http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-ui/v1.0/sstc-saml-metadata-ui-v1.0.html

That's really handy: I'll try it out.



> Also these are in fact data protection/privacy features so you can't
> just grab all the data (any time you want) about all subjects of an
> institution, even if those subjects have never used your service.
> You can update data on the next access. If you need the data in
> between visits you may cache/store it in your application (Provided
> there's a legal basis for that, cf. 95/46/EC).

Right! I'm not trying to grab all the data about the users. I'm trying
to make my App "organisation aware" and I'd like those App organisation
objects to be aware of the appropriate IdPs. From the Federation
Metadata it looked like I could get some friendly strings to prepopulate
my App's Organisation objects with.


>> What I'd really like to do is to prepopulate the IdP data in my app so
>> that I have an App object for hanging other data off of such as "This
>> IdP and these eMail domains identify users as belonging to this
>> institution", "this is the name/logo/description of this institution"
>> (for cases where it's not supplied by the IdP) and "these are App
>> objects for users of this institution". i.e. data that I obtain through
>> other sources.
> 
> The software doesn't keep you from doing any of that. Unless the data
> is available to it in a standardized way (i.e., SAML metadata) it
> won't make it magically appear, either.

So do I have to grovel for the Metadata files manually? The way I see
it, the downloading and management of those Metadata files is the
responsibility of the Shibboleth software so if I want to access them
then I should be careful to do it in the way the software expects.

Is just "somehow" finding out the locations of those files and then
reading them directly a legitimate thing to do? Do I have to manually
handle the detection of when they become updated?





Regards,
@ndy

-- 
andyjpb at knodium.com
http://www.knodium.com/