delegation in IDP3

[Brent Putman]

On 6/9/16 3:10 PM, Cantor, Scott wrote:
>> Apparently the schema is different for the v3 port.
> Hmm, you're right, I'm wrong. I guess the schema was changed. Or more to the point, the old type in the extension schema was added to the SAML relying-party schema that the IdP comes with for all the other profiles. Strange choice, I don't remember us deciding to do that, it seems odd to me.

It's complicated.  IIRC the support for the legacy config schema and
parsing was in 3.0 from the beginning.  Chad did that when he originally
ported things for v2.  I had to fix up some stuff when we actually added
runtime support for all that. 

>
> Anyway, I do see a SAML2SSOSProfile type in the "urn:mace:shibboleth:2.0:relying-party" namespace. But sure enough, I don't see a mapping in the code to handle that type. I think it's a bug. But it may be the bug was actually that we added it to the schema at all, Brent would have to comment there.

You do?  I'm not seeing that... I see it defined for
"urn:mace:shibboleth:2.0:relying-party:saml" in
shibboleth-relying-party-saml.xsd.

>
> The general line we took is that anything that wasn't part of the V2 code base wouldn't be accounted for in the legacy relying-party support, and would require migrating to the native version. This is straddling the fence, but is to my mind something I would have argued was on the extension side and would not have been supported.

Well, Chad had already done it before we even released 3.0. I think it
was just sitting in there without any of us realizing it.  So I had to
make it work.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160609/76f8f74a/attachment.html>