Paul
I think (someone will correct me if I'm wrong) that you can't use the SID as the EPTI because the Federation rules oblige you to return a different EPTI value to each SP.
Nigel
-----Original Message-----
From: Discussion list for Shibboleth developments [mailto:[log in to unmask]] On Behalf Of Paul Cheyne
Sent: 06 May 2009 14:43
To: [log in to unmask]
Subject: Re: Attribute Definitions and metadatatool
Afternoon all
I have put together a resolver.xml document which I would like to test. Is there a tool out there that allows me to query the directory to see if the attributes are mapping correctly. Also I have a question on eduPersonTargetID. Does shibboleth create Opaque string value or can I use something like SID from active directory for this attribute
Paul Cheyne
Support Consultant
RM (Aberdeen College)
Tel: 01224 (61)2550
Email: [log in to unmask]
-----Original Message-----
From: Discussion list for Shibboleth developments [mailto:[log in to unmask]] On Behalf Of Peter Schober
Sent: 06 May 2009 10:40
To: [log in to unmask]
Subject: Re: Attribute Definitions and metadatatool
* Lowry, Francis <[log in to unmask]> [2009-05-06 10:55]:
> Following on from Mike's response, there are additional options for
> sourcing the different attributes. We use a combination of Active
> Directory for the eduPrincipalName, a salt for the eduPersonTargetID,
> and a JDBC lookup to a SQL Server database for the affiliations and
> entitlements.
>
> This allows us to separate the management of entitlements which is a
> library function in our organsation from the AD management, on the basis
> that is is easier for us to maintain contents of database tables rather
> than add extra processing to maintain AD.
Just remember that depending on many data sources makes it harder to
achieve high(er) availability, if the need comes up. Sync'ing the data
to a single source (if management in one data source is not possible)
might provide for better resiliance (at other costs, of course).
E.g. in case you also use Shibboleth as your campus WebSSO system you
probably want to reduce the possibility of large parts of the campus
web becoming unavailable (for new sessions) because of an IdP-related
problem. Since Shib always talks to all data sources configured, that
extends the need for higher availablility to all storage engines
(databases, directories, etc.) upon the IdP depends for it's
operation. Each of which usually is both expensive and difficult to
get to a redundant, clustered mode of operation with realiable
fail-over and recovery, etc.
Cheers,
-peter
_________________________________________________________________
You might be interested in this...
RM ICT Tour 2009
With all the pressures placed on teaching staff today, it's increasingly difficult to
justify a full day out to research developments for the classroom. So you don't
miss out, we've teamed up with schools and local authorities to bring the latest
in ICT to a venue near you.
Visit http://www.rm.com/bus for more information and a full list of venues.
_________________________________________________________________
P.S. Think Green - don't print this email unless you really need to.
This message is confidential, so please treat it appropriately and for its intended purpose only. In particular, if it refers to any technical data, terms or prices not generally available or known, such items are "commercially sensitive information" within the terms of the Freedom of Information Act 2000 and related laws. As it would be prejudicial to RM's commercial interests if these were disclosed, please refrain from doing so.
As Internet communications are not secure, please be aware that RM cannot accept responsibility for its contents. Any views or opinions presented are those of the author only and not of RM. If you are not the intended recipient of this e-mail, please accept our apologies and arrange for copies of it to be deleted. For your information, RM may intercept incoming and outgoing email communications.
RM Education plc
Registered Office: New Mill House, 183 Milton Park, Abingdon, Oxfordshire, OX14 4SE, England
Registered Number: 1148594
|