Please help reduce SAML 1 usage in the UK federation (was: SAML1.1 attribute release on Shib 3)

[Rod Widdowson]

> because SPs use the WAYF protocol with our
> Central Discovery Service; 

Doesn't that give you an obvious vector to get the people to put their houses in order?  Detect the shibboleth discovery requests
which shouldn't be and react:

(I'm assuming that the WUGen thingy no longer emits SAML1 references, but there is no doubt a backlog of references out there).

You should be able to detect in the CDS

- Shibboleth discovery protocol from an SP which doesn't support SAML1 - and let it go by
- Shibboleth discovery protocol from an SP which does support SAML2 (via some suitable heuristics on the referrer)
- Shibboleth discovery protocol from an "embedded URL" (ditto)

The last two bullets represent an organisation which has taken its eye off the ball.  How to deal with them, I'd leave to you, but
for myself I'd create a suitable DS URL and throw up an interstitial page with some comment about "software out of date" or
"referring link out of date" on the same page and add the link, inviting the user to click on it.

What I wouldn't do it automatically forward to the DS link - the user won't get exactly what they expect and needs to know why (or
you'll get even more support calls), plus there has to be some pressure on the organization with the broken software.

R