Dynamic Configuration of IdP

[M]

The project team should be able to write whatever java code is needed to create or load the meta data.  However, I am unsure what you mean by loading the IdPs meta data.  I read up on Folder metadata provider and a metadata aggregate so I have some understanding of how they work.  So would one way to save the meta data be to have a file for each IdP in the Folder, which is then loaded?  The documentation says that new files will not be detected though, so how should new IdPs be handled?



------------------------------
On Mon, Sep 30, 2013 9:10 PM EDT Nate Klingenstein wrote:

>M,
>
>> 4. The support organization will fill out an online form to configure the IdP settings for each customer organization.  The settings will be saved to be used by Shibboleth to allow for single sign on.
>> 5. Each organization has its own login URL, so the system will know which IdP to use.  
>> 
>> Our main question relates to #4.  From our research, it looks like one way to save the IdP settings is to create a new shibboleth2.xml file each time an IdP is added or updated, but is this the best way?
>
>You'll need to load the IdP's metadata into your SP.  If you need the SP to "physically" prevent users from one IdP accessing services hosted for another IdP, you can load metadata in separate ApplicationOverride elements.  The application can do this itself too, of course.  If your application can handle this or it's not necessary…
>
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride
>
>> Our web application is in java, and has a database so are there better ways to save the settings?
>
>… then as long as you have the IdP's metadata loaded(e.g. a Folder metadata provider or a metadata aggregate),
>
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider
>
>you just need to set the entityID when initiating the session.  The easiest way to do this is usually just appending it to the query string, if you can do that, but there are many different ways to do it.  See:
>
>https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings
>
>Hope this helps,
>Nate.
>--
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net