School me on hub and spoke federations

[Tom Scavo]

On Mon, May 13, 2013 at 5:04 PM, Leif Johansson <leifj at sunet.se> wrote:
>
> However (as with any name-constraints-scheme) the more
> scopes you have on a single IdP the higher the risk of
> anything going wrong.

Yes, I found one hub-and-spoke federation that had 256 scopes on its
IdP Proxy. Clearly scoped attributes (such as eduPersonPrincipalName)
are not compatible with hub-and-spoke federations.

Let me put it another way. In a full mesh federation, the scope helps
prevent one IdP from asserting arbitrary identities. In a
hub-and-spoke federation, the IdP Proxy is All-Powerful in that it can
assert any identity it wants. Indeed, the IdP Proxy is a single point
of compromise.

Tom