search

janus-ssp / janus

Fully featured metadata registration administration module built on top of simpleSAMLphp.
Other
13 stars 8 forks source link

No SP to production when "No ARP" option is still checked #524

Open maartenk opened 9 years ago

maartenk commented 9 years ago

In the SURFconext Instance of Janus we use the test and production modes to an SP. One of the options in Janus on the SP is to set the ARP. Default mode for attribute release is "No ARP" set. When no ARP is set (the option 'No ARP' is checked) all attributes will released to specific SP (no attribute filtering). Although in test mode this can be viable route, in production mode this is undesirable and most likely a human error.

Two request: a) default an empty ARP, so no attributes a released instead of all. b) Block or warn when a config is saved, mode is production and ARP is not set.

One consideration: when an attribute manipulation is used, the No ARP option is required, because filtering will be done by the manual attribute manipulation.

HennyBekker commented 9 years ago

This will be a problem of services (like the Dashboard of SURFconext or the Profile service) to obtain all attributes served by the IdP.. Those services does not use an attribute manipulation script... (which however might be only containing comments)...

maartenk commented 9 years ago

Good point. At least a big warning.