<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>So, basically, there is no standard for this? I do see the home org attribute you spoke of:</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; background-color: transparent; font-style: normal;"><span><a href="http://macedir.org/ontologies/attribute/2012-11-10/attributeOntologyDoc/schachomeorganization.html">http://macedir.org/ontologies/attribute/2012-11-10/attributeOntologyDoc/schachomeorganization.html</a><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; background-color: transparent; font-style: normal;"><br></div><div><br></div> <div
style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <hr size="1"> <font size="2" face="Arial"> <b><span style="font-weight:bold;">From:</span></b> Leif Johansson <leifj@sunet.se><br> <b><span style="font-weight: bold;">To:</span></b> users@shibboleth.net <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, May 14, 2013 7:23 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: School me on hub and spoke federations<br> </font> </div> <div class="y_msg_container"><br><div id="yiv7995961617">
<div>
<div class="yiv7995961617moz-cite-prefix">On 05/14/2013 04:19 PM, Mike Flynn
wrote:<br>
</div>
<blockquote type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: arial, helvetica, sans-serif; font-size: 12pt;">
<div><span>OK, since I will have to identify the organization
through an attribute instead of the entityID, what is an
appropriate attribute for doing this that would be
reasonable for the hub and spoke based institutions to
support?</span></div>
<div><br>
</div>
</div>
</blockquote>
There is a scope thing (not the shibboleth extension by that name)
inside the <br>
AuthnRequest. Some support that. Others - especially those in
R&E space - <br>
use schacHomeOrganization set to the domain of the org.<br>
<br>
Cheers Leif<br>
<br>
<blockquote type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: arial, helvetica, sans-serif; font-size: 12pt;">
<div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;">
<div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;">
<div dir="ltr">
<hr size="1"> <font face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Tom Scavo
<a rel="nofollow" class="yiv7995961617moz-txt-link-rfc2396E" ymailto="mailto:trscavo@gmail.com" target="_blank" href="mailto:trscavo@gmail.com"><trscavo@gmail.com></a><br>
<b><span style="font-weight:bold;">To:</span></b> Shib
Users <a rel="nofollow" class="yiv7995961617moz-txt-link-rfc2396E" ymailto="mailto:users@shibboleth.net" target="_blank" href="mailto:users@shibboleth.net"><users@shibboleth.net></a> <br>
<b><span style="font-weight:bold;">Sent:</span></b>
Monday, May 13, 2013 2:29 PM<br>
<b><span style="font-weight:bold;">Subject:</span></b>
Re: School me on hub and spoke federations<br>
</font> </div>
<div class="yiv7995961617y_msg_container"><br>
On Mon, May 13, 2013 at 5:04 PM, Leif Johansson <<a rel="nofollow" ymailto="mailto:leifj@sunet.se" target="_blank" href="mailto:leifj@sunet.se">leifj@sunet.se</a>>
wrote:<br>
><br>
> However (as with any name-constraints-scheme) the
more<br>
> scopes you have on a single IdP the higher the risk
of<br>
> anything going wrong.<br>
<br>
Yes, I found one hub-and-spoke federation that had 256
scopes on its<br>
IdP Proxy. Clearly scoped attributes (such as
eduPersonPrincipalName)<br>
are not compatible with hub-and-spoke federations.<br>
<br>
Let me put it another way. In a full mesh federation, the
scope helps<br>
prevent one IdP from asserting arbitrary identities. In a<br>
hub-and-spoke federation, the IdP Proxy is All-Powerful in
that it can<br>
assert any identity it wants. Indeed, the IdP Proxy is a
single point<br>
of compromise.<br>
<br>
Tom<br>
--<br>
To unsubscribe from this list send an email to <a rel="nofollow" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="yiv7995961617mimeAttachmentHeader"></fieldset>
<br>
<pre>--
To unsubscribe from this list send an email to <a rel="nofollow" class="yiv7995961617moz-txt-link-abbreviated" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
</div>
</div><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br></div> </div> </div> </div></body></html>