Environment Planning and Design Assistance

[Nate Klingenstein]

Adam,

I would start from the use cases that you are looking at.  Without
knowing how or why the 30 directories are different from one another,
it's very hard for us to guess at a minimally coherent infrastructure
for you.

Everything you discuss is technically possible, but make sure you're
aware of what you signed up for and the full policy implications of
hosting personal data.

Some of your questions, like getting IdP's to "trust each other", are
a little broad and hard to interpret.

It is likely that your nightmare is your best case scenario.

For the final query, the data has to be accessible to the requester.
You could use LDAP if that's considered secure enough, you could pass
the attribute in the SAML assertion, whatever.

I would recommend that you spend some good, hard time thinking through
the architecture you intend to build and how you intend to manage the
deployment within the legal and policy constraints the schools will
impose on you.  It'll be easier to plan ahead than backfill, and I
think some planning would do you well.

Take care,
Nate.