IDP 4.3 and non URL SP entity IDs

[Wessel, Keith]

So by setting this property to true, I risk not conforming to proxying standards, but little else, correct?

I'm considering creating a condition bean that returns true if the entity ID of the SP isn't a URN or URL format  as to not break Azure but false otherwise, but I'm wondering if it's worth it.

Keith


-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Thursday, January 19, 2023 4:04 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: IDP 4.3 and non URL SP entity IDs

> Scott, I'm failing to understand the risk of setting ignoreScoping to 
> true if there is one.

Standards compliance, and honoring limitations on proxying that no SP in the world is probably populating.

> And what are the ramifications of passing them through vs. having the 
> IdP generate its own, other than the obvious issue with Microsoft that 
> Roberto reported?

It's not a passthrough. The contents of the request's Scoping element will depend on whether the original request had one and what was in it. ProxyCount has to be decremented if set (or enforced if it's zero), and the RequesterID list is supplemented by the latest one.

I piggybacked on the ignore flag to provide a way to prevent the IdP creating its own element if there wasn't already one to supplement, and this was why.

-- Scott