Verifying Entity ID is in metadata

[Spencer Thomas]

As an SP, we allow our customers to tell us that they are using Shibboleth for authentication, at which time they provide us with the EntityID of their IdP.  Currently, our support staff validate their configuration – in particular, confirming that the EntityID in (at least) one of the federation metadata aggregates that we use.

We are now building a “Self Service” portal that would, among other things, allow them to set up their Shibboleth configuration themselves.  We would like to be able to programmatically verify that the EntityID they give us is one that we can use (i.e., that it maps to an IdP in federation metadata.) We could clearly do this by reading the federation metadata into an independent service and then checking that there is an IdP entry with that EntityId, but I’m not happy about the duplication of effort that would take.

So, my question: Is there an API on shibd (currently 3.0.4) that we could use for this purpose?

I guess we could construct a /Shibboleth.sso/Login URL with the entity ID. If it gets forwarded, then the entity ID is valid, and if we get an error, it’s not.

Is there a more elegant way of doing this?

Thanks.

--
Spencer Thomas
Technical Architect / JSTOR and Artstor
ITHAKA<https://www.ithaka.org/> / 301 E. Liberty St, Suite 250, Ann Arbor, MI 48104
Email: Spencer.Thomas at ithaka.org<mailto:Spencer.Thomas at ithaka.org>
Voicemail: 734-887-7004





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210203/dc5019a8/attachment.htm>