A question for Shibboleth SPs regarding on-boarding process for IDPs

[Cantor, Scott]

On 4/22/15, 4:39 PM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:



>Does anyone automate this process at all?  Currently we have a maint 
>window daily and I have two boxes running shib behind an LB.  I update 
>these machines daily with new IDP metadata and the occasional custom 
>attribute.  Has anybody implemented automation for this process so that 
>the IDP can carry out this function on a web page or something instead of 
>requiring manual intervention to get the data loaded up?

Well, testshib would be a pseudo-example, though not a spectacularly 
effective one because the backers have decided against investing in it.

There are lots of SPs that do this through self-service via admin 
accounts, but the majority don't use Shibboleth and don't care about the 
security of the system as a whole. They're silos offering access to data 
that belongs to the IdP, so for them it's just whatever gets this done 
with the least effort for them. Devolving all responsibility to the site 
admin is the simple way to do that, and sadly it's better for me as a site 
admin to have that full control than doing a poor job with a more 
Shibboleth-like model but not fully supporting that model either. I 
suppose it amounts to saying that either extreme is better than trying to 
combine models.

I hammer on the data ownership point in these conversations because it's 
really the key. Once you have data being accessed by IdPs that don't own 
it, the whole paradigm shifts toward a model that I believe only the 
HE-style federations have tried to handle.

Certainly the architecture of the SP is such that any tools that can 
generate the necessary XML behind them should be able to handle a 
provisioning process, but there's nothing "off the shelf" certainly. 
That's arguably something we should look at.

-- Scott