Blacklisting idps

[Tom Scavo]

On Wed, Jun 3, 2015 at 8:42 AM, Ondřej Košarko <kosarko at ufal.mff.cuni.cz> wrote:
>
> 2015-06-03 14:16 GMT+02:00 Tom Scavo <trscavo at gmail.com>:
>>
>> On Wed, Jun 3, 2015 at 4:55 AM, Ondřej Košarko <kosarko at ufal.mff.cuni.cz>
>> wrote:
>> >
>> > In my configuration of shibboleth sp 2.5.3 I have several
>> > MetadataProviders
>> > (federations), now I need to blacklist some IDPs from some of the
>> > federations.
>>
>> A different set of IdPs from each federation? Are the sets disjoint?
>
> No, these sets are not disjoint, some of the IDPs are member of more than
> one federation.

Okay, well, regardless of how you do metadata aggregation, you're
going to have to deal with that problem. Do you recognize the first
occurrence or the last occurrence of any given IdP? I believe the SP
can implement either of those policies.

>> > I know I can add a MetadataFilter to each of the providers element, but
>> > I'd
>> > rather keep the blacklist in one piece. Is that somehow possible?
>>
>> I'm not sure why you would want to do that...is the same IdP in
>> multiple metadata feeds?
>
> Apart from IDPs being in multiple feeds, it seems more manageable and
> convenient to have just one place where to add or check the blacklist.

The SP has very sophisticated metadata aggregation capabilities but I
think you'll need a standalone metadata aggregator to do what you
want. There is the Shibboleth Metadata Aggregator and there is pyFF
(pyff.io). Your mileage may vary.

Tom