Environment Planning and Design Assistance

[Cantor, Scott]

> Is it better to have one IdP with 30+ directories or will this cause logins to
> take forever.

If you're talking about fall-thru to all 30, no, I think that's unworkable in practice. Certainly less than desirable.

> This is what I am preferring now, as the searchfilter would use mail to find
> the user, eliminating the need for WAYF DS.

Well, you can certainly look at a more sophisticated use of the code, but mostly it's stuff that's unreleased. 3.3 will allow, for example, runtime determination of the JAAS config to use, which is one way of combining 30 LDAP configs but only calling one for login.

Attribute resolution would have to get pretty fancy too, though, and that probably would be harder to partition up and avoid wasted queries.

> Or, would it be better to have multiple IdP's, one per school. This would end
> up with over 30 IdP's which sounds like a management nightmare.

Well, IdPs are *meant* be to per-organization. Whether it's manageable, I couldn't say. It probably depends how different the configurations would be. Having 30 totally non-uniform back-ends, yeah, that would be a mess, I agree.

> Also, is it possible to get multiple IdP's to "trust" eachother?

Shibboleth does not provide SP functionality in the IdP, it doesn't proxy. SimpleSAML is a better choice for that approach.

> Other than setting the SP to accept multiple IdP's, is there a way to configure
> IdP "trust"

Yes, gateways, in which you own the problem of multiple IdPs to offload that from some SP. Somebody has to own the problem.

-- Scott