managing untrusted metadata

[Cantor, Scott]

> The other aspect of "trusted metadata" which you may be hinting at is one I
> care a lot about when it comes to attribute release (or NameIDs, doesn't
> matter as under EU law it's all PII now) and for me it boils down to "sufficient
> checks performed during registration"
> (and we'll have varying defintions for "sufficient"):

Ah, right, and for the record, OSU does not release attributes based on anything that's in metadata (except local EntityAttributes I use), so all of that is just ignored by my system. We have a default policy for everything and then we create exceptions for additional data. This does not result in data minimization, but if that were the goal, we would just not operate a usable IdP, can't get more minimal.

GDPR may well push us that way; my university is taking it very seriously, and I don't know if the openly federating model can survive it, honestly, but I suspect consent is about to get a lot more important for me. My registrar shot that down last time I tried, but it's probably going to be either that, or nothing.

-- Scott