<div dir="ltr"><div class="gmail_default" style="font-family:'courier new',monospace"><br></div><div class="gmail_extra"><div class="gmail_quote">On Tue, Mar 4, 2014 at 1:24 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">On 3/4/14, 4:18 PM, "Jeffrey Crawford" <<a href="mailto:jeffreyc@ucsc.edu">jeffreyc@ucsc.edu</a>> wrote:<br>
><br>
>Well okay so if an SP doesn't even get NamedID it's supposed to handle<br>
>that?<br>
<br>
</div>Yes, as a matter of basic input validation.<br></blockquote><div><div class="gmail_default" style="font-family:'courier new',monospace"></div><div class="gmail_default" style="font-family:'courier new',monospace">
Well therein lies the problem, if we are not sending attributes an app wants and it behaves badly we might be causing error pages go up with sensitive information. Not our or InCommons problem yes but it still doesn't help.</div>
</div><div class="gmail_default" style="font-family:'courier new',monospace"><br></div><div class="gmail_default" style="font-family:'courier new',monospace">Additionally our current setup makes it very easy for support personal to know if we are supporting an InCommon application or not. I tested with a test SP and even though it received no variables it allowed a login. That would be pretty big change to the way things work today. Especially since there is not lot of use of InCommon apps currently</div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class=""><br>
>It doesn't look like Metadata Filtering is going to help in this case so<br>
>It's starting to look like I'm going to have to change from relying-party<br>
>based to filter based.<br>
<br>
</div>I don't see any reason why filtering isn't exactly the solution. You don't<br>
even need to write Java code, you could build a cron job to pull in<br>
metadata and run it through an XSLT script.<br></blockquote><div><br></div><div class="gmail_default" style="font-family:'courier new',monospace">As long as the file is present and being updated the IdP will continue to read it correct, or did I miss someplace that requires configuration that the IdP periodically reads the file?</div>
<div><br></div><div><div class="gmail_default" style="font-family:'courier new',monospace">Well this will incur a special kind of madness :). If I may post an example to work with xlstproc, we want to allow certin entityID's and all entityID's that are part of RandS (by the way I don't pretend to know xslt all that well) does this look resonable?:</div>
<div class="gmail_default" style="font-family:'courier new',monospace">===========================</div><div class="gmail_default"><div class="gmail_default"><font face="courier new, monospace"><?xml version="1.0" encoding="utf-8"?></font></div>
<div class="gmail_default"><font face="courier new, monospace"> <xsl:stylesheet</font></div><div class="gmail_default"><font face="courier new, monospace"> xmlns:xsl="<a href="http://www.w3.org/1999/XSL/Transform">http://www.w3.org/1999/XSL/Transform</a>"</font></div>
<div class="gmail_default"><font face="courier new, monospace"> xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema">http://www.w3.org/2001/XMLSchema</a>"</font></div><div class="gmail_default"><font face="courier new, monospace"> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"</font></div>
<div class="gmail_default"><font face="courier new, monospace"> xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"</font></div><div class="gmail_default"><font face="courier new, monospace"> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"</font></div>
<div class="gmail_default"><font face="courier new, monospace"> xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"</font></div><div class="gmail_default"><font face="courier new, monospace"> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"</font></div>
<div class="gmail_default"><font face="courier new, monospace"> exclude-result-prefixes="xs md mdattr saml"</font></div><div class="gmail_default"><font face="courier new, monospace"> version="1.0"></font></div>
<div class="gmail_default"><font face="courier new, monospace"><br></font></div><div class="gmail_default"><font face="courier new, monospace"> <xsl:output method="xml" indent="yes"/></font></div>
<div class="gmail_default"><font face="courier new, monospace"> <xsl:strip-space elements="*" /></font></div><div class="gmail_default"><font face="courier new, monospace"><br></font></div><div class="gmail_default">
<font face="courier new, monospace"> <!-- Pull in the default stuff --></font></div><div class="gmail_default"><font face="courier new, monospace"> <xsl:template match="@*|node()"></font></div>
<div class="gmail_default"><font face="courier new, monospace"> <xsl:copy></font></div><div class="gmail_default"><font face="courier new, monospace"> <xsl:apply-templates select="@*|node()"/></font></div>
<div class="gmail_default"><font face="courier new, monospace"> </xsl:copy></font></div><div class="gmail_default"><font face="courier new, monospace"> </xsl:template></font></div><div class="gmail_default">
<font face="courier new, monospace"><br></font></div><div class="gmail_default"><font face="courier new, monospace"> <!-- Very large if statement to make sure we get entries we need --></font></div><div class="gmail_default">
<font face="courier new, monospace"> <xsl:template match="md:EntitiesDescriptor/md:EntityDescriptor"></font></div><div class="gmail_default"><font face="courier new, monospace"> <xsl:if test="@entityID = 'urn:mace:incommon:<a href="http://ucsc.edu">ucsc.edu</a>' or</font></div>
<div class="gmail_default"><font face="courier new, monospace"> @entityID = '<a href="https://www2.ucsc.edu/shibboleth">https://www2.ucsc.edu/shibboleth</a>' or</font></div><div class="gmail_default">
<font face="courier new, monospace"> @entityID = '<a href="https://uc.sumtotalsystems.com/shibboleth">https://uc.sumtotalsystems.com/shibboleth</a>' or</font></div><div class="gmail_default"><font face="courier new, monospace"> @entityID = '<a href="https://ucsso.travelprefs.com">https://ucsso.travelprefs.com</a>' or</font></div>
<div class="gmail_default"><font face="courier new, monospace"> md:Extensions/mdattr:EntityAttributes/saml:Attribute[@Name != '<a href="http://macedir.org/entity-category']/saml:AttributeValue[text()='http://id.incommon.org/category/research-and-scholarship'">http://macedir.org/entity-category']/saml:AttributeValue[text()='http://id.incommon.org/category/research-and-scholarship'</a>]"></font></div>
<div class="gmail_default"><font face="courier new, monospace"> <EntityDescriptor></font></div><div class="gmail_default"><font face="courier new, monospace"> <xsl:apply-templates select="@*|node()"/></font></div>
<div class="gmail_default"><font face="courier new, monospace"> </EntityDescriptor></font></div><div class="gmail_default"><font face="courier new, monospace"> </xsl:if></font></div><div class="gmail_default">
<font face="courier new, monospace"> </xsl:template></font></div><div class="gmail_default"><font face="courier new, monospace"><br></font></div><div class="gmail_default"><font face="courier new, monospace"> </xsl:stylesheet></font></div>
</div><div class="gmail_default" style="font-family:'courier new',monospace">===========================</div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span class=""><font color="#888888"><br>
-- Scott<br>
</font></span><div class=""><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>