Blacklisting idps

[Ondřej Košarko]

2015-06-03 14:16 GMT+02:00 Tom Scavo <trscavo at gmail.com>:

> On Wed, Jun 3, 2015 at 4:55 AM, Ondřej Košarko <kosarko at ufal.mff.cuni.cz>
> wrote:
> >
> > In my configuration of shibboleth sp 2.5.3 I have several
> MetadataProviders
> > (federations), now I need to blacklist some IDPs from some of the
> > federations.
>
> A different set of IdPs from each federation? Are the sets disjoint?
>

No, these sets are not disjoint, some of the IDPs are member of more than
one federation.


> > I know I can add a MetadataFilter to each of the providers element, but
> I'd
> > rather keep the blacklist in one piece. Is that somehow possible?
>
> I'm not sure why you would want to do that...is the same IdP in
> multiple metadata feeds?
>

Apart from IDPs being in multiple feeds, it seems more manageable and
convenient to have just one place where to add or check the blacklist.


>
> > I did try to have one "top level" MetadataProvider with type chaining and
> > the filter inside this element, but that did not seem to work.
>
> That doesn't seem too surprising since a chaining MetadataProvider is
> mostly syntactic sugar at this point.
>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150603/f9d21ee7/attachment.html>