options for using wildcard or shortcuts for URL's in shibboleth2.xml and sp metadata

[Cantor, Scott]

On 11/15/17, 2:28 PM, "users on behalf of Ewing, Bill" <users-bounces at shibboleth.net on behalf of BEwing at utsystem.edu> wrote:

> So in short is there a way to wildcard the handlerurl and various metadata urls needed for the applicationoverride such that we
> can avoid having to be explicit in the path for however many  variations there are for example:

You can assign overrides via regex but you can't have a handlerURL that's anything but explicit. Path based overrides are a terrible idea, don't do them. Whatever you're trying to do needs a different approach from the beginning if you ever go down that road.

> Any direction or examples or a flat out no you cant do that would be appreciated.

Overrides are pretty much never the right answer to anything except in simple vhost -> entityID hosting scenarios.

I don't think step up is worth it anymore, people are rapidly figuring out that requiring MFA to begin with is the simpler choice. But if I had to come up with a way that was outside the application, I would probably try to just slap in require rules to check the context class, and have it handle the 403 errors by messing with Apache and have them redirect the user through the SP to trigger the step up.

-- Scott