Handling Scope for AD as an IdP to linux shibboleth SPs

[Alan Buxey]

hi,

I manage several hundred linux / apache website SPs, and several of the
> remote IdPs we authenticate to are Microsoft Active Directory servers. If
> we give the raw AD IdP metadata to the SPs, then the SP won't authenticate
> users because the IdP fails to assert a Scope. We have one (1) partner who
> provides scoped metadata for their IdP and everyone else requires us to
> maintain a scoped copy of their metadata for them.
>

adfs2fed.py is a handy tool - this has also been rewritten in powershell.
if the SPs are configured to use MDQ then they can pull the correct
metadata from the one single corrected version. this all avoids hand
editing


>    1. bypass options for the SP to ignore the AD IdPs' scope check?
>
>
for internal-only and non-global federated, you might get away with not
doing scope checks - however, some attributes are supposed to have a
scope..so if the IdP is releasing values expected to have scope then
that'll be more work.
for those with scope requirements its because at a globally available SP
you HAVE to have scope or else jane.smith from Purdue University cannot be
distinguished from janet.smith from University of Sydney or jane.smith from
Uppsala Universitet

so summary TL;DR; , keep local sane Metadata version somewhere reachable
from all SPs and get those SPs to pull that metadata resource.

alan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250129/c1b47382/attachment.htm>