Uploaded image for project: 'Identity Provider'
  1. Identity Provider
  2. IDP-1123

Optimize the default entityID at install time

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Completed
    • Affects Version/s: 3.0.0, 3.1.0, 3.2.0, 3.3.0
    • Fix Version/s: 3.4.0
    • Component/s: Installer
    • Labels:
      None
    • Operating System:
      Multiple

      Description

      At the time of installation, the IdP entityID defaults to a URI given by this line of code in build.xml:

      <input message="SAML EntityID:" addproperty="entityid"
      defaultvalue="https://${idp.host.name}/idp/shibboleth" />
      

      where idp.host.name is given by:

      <input message="Hostname:" addproperty="idp.host.name" defaultvalue="${NAME}.${DOMAIN}" />
      

      That particular default entityID is suboptimal for at least two reasons:

      1. Since the entityID is a name, not a location, the host part of the entityID need not be the same as the host part of the endpoint locations
      2. The string "shibboleth" is a type of "vendor lock-in"

      Once defined, an entityID should NEVER change. Changing an entityID is essentially starting from scratch. In that sense, the entityID is permanent and so it's value must be chosen with great care.

      I don't want to be prescriptive but the following default entityID is preferable to the one above:

      <input message="SAML EntityID:" addproperty="entityid"
      defaultvalue="https://${DOMAIN}/idp" />
      

      That is a much better entityID since it only depends on the domain, which rarely changes.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              rdw@iay.org.uk Rod Widdowson
              Reporter:
              trscavo@internet2.edu Thomas Scavo
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 3 hours Original Estimate - 3 hours
                  3h
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours
                  4h