Pass dynamic properties from SP to IdP

[Jacob Lundberg]

On Tue, 2013-09-03 at 15:03 -0400, Kevin P. Foote wrote:
> The IdP UI should for the most part not change a whole lot on your user
> base..

That would be nice, but our client institutions require that we skin the
login to match their application.  Users may or may not realize they are
logging in to the same account when accessing different clients'
applications.  It isn't great for us (or, arguably, the users) but we
try to do what our clients want when we can...

Our uses of Shibboleth (I have noticed) are often out on the fringe
and/or probably not what its designers had in mind.  However, I would
bet that somewhere somebody else does something similar.

On Tue, 2013-09-03 at 19:04 +0000, Cantor, Scott wrote:
> If you need different behavior per app, you should assign it a separate
> entityID. It's just not worth creating two levels of classification, we
> tried that originally and it failed for all sorts of reasons.

We have somewhere on the order of twelve thousand sub-applications and
new ones come or old ones go constantly.  I hate to imagine what life
would be like for our shibboleth administrators if we had to modify the
configuration for each of them.  I am sure we have seen some of your
original problems but I think what we have now is a better solution to
our problem than what you suggest.

-Jacob

-- 

Jacob Lundberg
Director, IT Services
jacob at collegenet.com
503.290.0100 (voice)
503.973.5252 (fax)
503.901.8343 (cell)