Setting AttributeConsumingIndex in IdP 4

[tomas.stenlund at telia.com]

Thanks for you quick reply Scott 🙂

No, unfortunately I do not control any of the IdP:s. This one require an AttributeConsumingService, none of the others do. They, the external IdP, use it to know which backend system they need to contact to be able to put together the attributes in the response. They have a lot of backend systems they need to contact and want to keep that to a minimum.

So I guess my option would be:

  1.  Add an AttributeConsumingService in my proxys SP-metadata as default and have it contain the sum of all attributes from all IdP:s and set them as not required. Then I only get one SP-metadata for the proxy.
  2.  Make a specific SP-metadata for just that IdP, meaning I need to manage two different sets for the same SP.
  3.  Go to IdP5

I am starting to think number 2 would be the cleaner one.

Cheers,

Tomas

________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, November 1, 2023 17:30
To: Shib Users <users at shibboleth.net>
Cc: tomas.stenlund at telia.com <tomas.stenlund at telia.com>
Subject: Re: Setting AttributeConsumingIndex in IdP 4

There is no practical means of doing this in 4, just some very advanced low level ways.

I would rethink your approach altogether unless you control all the IdPs because nothing but Shibboleth supports that mechanism to begin with, and there are few if any deployers of Shibboleth that would honor it. It acts as a filtering mechanism by default, but it won't cause attributes to be produced or released, and the lack of booleans in the articulation of requirements makes it largely worthless in practice.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231101/2a3c2056/attachment.htm>