Interfederation

["Cantor, Scott" <>]

On 4/3/13 6:02 PM, "Tom Scavo" 
<>
 wrote:
>I can't agree with that. Permitting that kind of redundancy will lead
>to situations where different scopes are published at various levels.
>In the very least it is semantically unsettling.

Formally, I consider the definition to be "entity level". The role thing
was a legacy option that we had to support.

But federations have to deal with older software, and so they don't have
much choice. But I would be very disappointed with an outcome of "role
only" since that is not the definition of the element today. That is not
really subject to discusson since this is not a standard, but an extension
defined by me for my software.

>Then we would have a larger problem since the metadata for an IdP
>Proxy contains both an <md:IDPSSODescriptor> element and an
><md:SPSSODescriptor> element, and you wouldn't want to put a
><shibmd:Scope> element in the <md:Extensions> element of the
><md:EntityDescriptor> element in that case.

There is no problem there. The extension should apply only to roles that
produce attributes. It has no meaning for others.

-- Scott