HTML hyperlink in MDUI Description

[Doan, Tommy]

I've been asked to allow one of our trusted local SPs to include an HTML hyperlink in their SP MDUI Description when displayed at our IdP.

I haven't found way to do this by escaping the HTML within the XML of the MDUI element. However, if I modify the login.vm on the IdP to display $desc without putting it through the encodeForHTML function, the hyperlink displays fine. I just put the HTML href into CDATA within the mdui:Description element of the SP metadata.

<mdui:Description xml:lang="en">For other information <![CDATA[<a href="http://domain.com/login">click here</a>]]></mdui:Description>

Of course there are legitimate concerns for using the encodeForHTML function here when the metadata is not trusted. In this case, the metadata is trusted, but I don't know how to inform login.vm about trusted vs untrusted metadata. I suppose I could allow unencoded $desc only from this particular $rpContext.getRelyingPartyId(). However, is it possible to signal for login.vm whether an SP is a member of our local entities (something like EntitiesDescriptor) and handle those separately from others?

Basically I'm looking for guidance on how to accomplish this in a way I won't regret, or justify why we shouldn't do it.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171116/c81990cf/attachment-0001.html>