delegation in IDP3

[Cantor, Scott]

On 6/9/16, 6:15 PM, "users on behalf of Robert A Basch" <users-bounces at shibboleth.net on behalf of rbasch at mit.edu> wrote:

>As for legacy vs. new format, we plan to update to the new format
>eventually, but we have a lot of <RelyingParty> definitions, so
>I was putting it off until later. Many of these were added for
>SPs doing delegation, so having documentation on how to do that in
>the new format would be helpful in updating.

The javadoc is all there is. I haven't really even documented the ordinary profile settings, we just have more examples and defaults for them.

https://build.shibboleth.net/nexus/content/sites/site/java-identity-provider/3.2.1/apidocs/

The class is net.shibboleth.idp.saml.idwsf.profile.config.SSOSProfileConfiguration

I don't know if there are issues with the conversion of settings. Ordinary profile settings mostly map in obvious ways.

In practice (delegation aside) it's common for many existing RP definitions to go away. I got rid of 90% of mine, and the few that were left collapse into smaller ones that just have enumerations of the SPs they apply to. If you have common settings across multiple RPs, that's just one override now. That's why it ends up saving time to just make the change.

-- Scott