Acceptable Use of ApplicationOverrides in SPv3 and SPv4

[Bryan K. Walton]

We are an SP that works with about 450 different IdPs.  As such, we have
to make use of a lot of ApplicationOverride sections.  I know that the
Shibboleth project thinks this isn't a very good practice, but each of
these IdPs have different attribute mappings, metadata urls,
redirectAllow urls, and session/lifetime timeout settings.

Based upon the Shibboleth SP documentation, we are now experimenting
with using a setting in the Apache virtualhosts to move
entityID out of the Application Override:

`ShibRequestSetting entityID https://idp.XXXXXXX/idp/shibboleth`
(I've obscured the Idp for this email.)

Regarding the other overrides:
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2063696335/ApplicationOverride#Valid-and-Invalid-Reasons-for-Overrides
talks about the valid and invalid reasons for using overrides.  It seems
like most of our reasons are valid in version 3 and most of these will
still be around in version 4, if my reading of the new documentation is
correct.  Please correct me if I'm wrong.

However, because we work with so many IdPs, we also make heavy use of
the LowerCase AttributeResolver plugins to lowercase attributes that
come in to us in an inconsistent case format.  We don't control any of
these IdPs.

Why is this feature being removed?

Thanks,
Bryan

-- 
Bryan K. Walton						  319-337-3877 
Senior Linux Systems Administrator	    Leepfrog Technologies, Inc