<div dir="ltr"><div>Scott,<br><br></div>I think I may have figured it out…I didn't include metadata for this SP, but they are a member of InCommon and I do look at InCommon's metadata.<br><div><br>If it helps, the SP I'm talking about it <a href="https://dmp.cdlib.org">https://dmp.cdlib.org</a> -- I see Ohio State is also on the list of institutions so maybe you can explain how you set it up for them?<br>
<br></div><div>Is referring to the InCommon metadata and creating a filter policy enough? It seems to work, but I want to make sure I'm doing things the right way.<br><br>Thanks,<br></div><div>Ian<br></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Tue, Aug 20, 2013 at 3:02 PM, Ian Rifkin <span dir="ltr"><<a href="mailto:irifkin@brandeis.edu" target="_blank">irifkin@brandeis.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi,<br><div><div class="gmail_extra"><br></div><div class="gmail_extra">Thanks so much for your responses…<br></div><div class="gmail_extra"><br><div class="gmail_quote"><div class="im"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
You should probably determine why you're mistaken. You do NOT have a<br>
system that would ever respond to an SP without metadata provided, so your<br>
impression that that works is incorrect.<br></blockquote><div><br></div></div><div>Can you help me determine why I'm mistaken? If I go to the SP's URL and click to login I see that I'm taken to my shibboleth IdP and sent back to them and the vendor claims I'm logged in and is in possession of the attribute I released to them. I assumed that since I'm able to login that it's working…<br>
</div><div class="im"><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>Then it wouldn't be released, but there is no evidence of who an SP is<br></div>
without metadata, and that's the meaning of anonymous.<br>
</blockquote><div><br></div></div><div>Do you mean that without metadata my configuration would work but that anyone could spoof being the SP and use the IdP to gain access to attributes? And if so how does creating a metadata file for them prevent that? Or do you mean something else?<br>
<br></div><div>Sorry, I'm a bit new at using Shibboleth! I have it up and running, but don't fully understand all the intricacies yet. Some SP vendors are easier to work with than others!<br></div><div><br></div>
<div>
Thanks again,<br></div><div>Ian <br></div></div></div></div></div>
</blockquote></div><br><br clear="all"><br>-- <br>Ian Rifkin '04, MS '09<br>Software Systems Manager<br>Library and Technology Services (LTS)<br>Brandeis University<br><br><a href="http://go.brandeis.edu/u:irifkin" target="_blank">http://go.brandeis.edu/u:irifkin</a>
</div>