Blacklisting idps

[Ondřej Košarko]

2015-06-03 14:55 GMT+02:00 Tom Scavo <trscavo at gmail.com>:

> On Wed, Jun 3, 2015 at 8:42 AM, Ondřej Košarko <kosarko at ufal.mff.cuni.cz>
> wrote:
> >
> > 2015-06-03 14:16 GMT+02:00 Tom Scavo <trscavo at gmail.com>:
> >>
> >> On Wed, Jun 3, 2015 at 4:55 AM, Ondřej Košarko <
> kosarko at ufal.mff.cuni.cz>
> >> wrote:
> >> >
> >> > In my configuration of shibboleth sp 2.5.3 I have several
> >> > MetadataProviders
> >> > (federations), now I need to blacklist some IDPs from some of the
> >> > federations.
> >>
> >> A different set of IdPs from each federation? Are the sets disjoint?
> >
> > No, these sets are not disjoint, some of the IDPs are member of more than
> > one federation.
>
> Okay, well, regardless of how you do metadata aggregation, you're
> going to have to deal with that problem. Do you recognize the first
> occurrence or the last occurrence of any given IdP? I believe the SP
> can implement either of those policies.
>

If I am not mistaken the SP by default uses first occurrence. Haven't seen
any trouble regarding this so far.


>
> >> > I know I can add a MetadataFilter to each of the providers element,
> but
> >> > I'd
> >> > rather keep the blacklist in one piece. Is that somehow possible?
> >>
> >> I'm not sure why you would want to do that...is the same IdP in
> >> multiple metadata feeds?
> >
> > Apart from IDPs being in multiple feeds, it seems more manageable and
> > convenient to have just one place where to add or check the blacklist.
>
> The SP has very sophisticated metadata aggregation capabilities but I
> think you'll need a standalone metadata aggregator to do what you
> want. There is the Shibboleth Metadata Aggregator and there is pyFF
> (pyff.io). Your mileage may vary.
>

Thanks for the tip. I'll check it out


>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150603/2bc35793/attachment.html>