Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung Nächste ÜberarbeitungBeide Seiten der Revision | ||
de:discovery [2020/04/21 16:31] – Silke Meyer | de:discovery [2021/03/04 09:20] – Silke Meyer | ||
---|---|---|---|
Zeile 1: | Zeile 1: | ||
- | ====== | + | ====== Discovery ====== |
<callout color="# | <callout color="# | ||
- | Der Discovery Service | + | A Discovery Service |
</ | </ | ||
- | * [[https:// | + | A Discovery Service is also known as " |
- | * Zentrale, vom DFN betriebene Instanzen (zur Integration im Shibboleth SP siehe [[https:// | + | |
- | * URL für die Testföderation: | + | |
- | * Diverse Instanzen für den [[de: | + | |
- | * [[de: | + | |
- | * [[de: | + | |
- | {{tag> | + | There are three ways Discovery can be realized: |
+ | * An SP is configured to redirect to a central public Discovery Service, e.g. one that is run by a federation operator. | ||
+ | * An SP runs an Embedded Discovery Service itself. | ||
+ | * An SP is configured to redirect to one static Identity Provider (no Discovery Service in the proper sense). | ||
+ | |||
+ | ===== DFN's central Discovery Services ===== | ||
+ | |||
+ | We run public Discovery Services that can be used by SP operators. These Discovery Services fetch information about available IdPs from the current metadata for DFN-AAI (Advanced), DFN-AAI-Basic, | ||
+ | |||
+ | * For Shibboleth SPs, the integration is documented on the page about [[en: | ||
+ | * For SimpleSAMLphp SPs, please refer to their [[https:// | ||
+ | * To use the Discovery Service in our test federation, please use the URL '' | ||
+ | |||
+ | ===== Embedded Discovery Service ===== | ||
+ | An Embedded Discovery Service (EDS) is run locally on the SP. It also relies on federation metadata to get an up-to-date list of the available IdPs. | ||
+ | |||
+ | In many cases, an EDS is more **user-friendly** than redirection to a central Discovery Service: | ||
+ | * The selection of home organizations can be designed in the look and feel of the Service Provider. Users are not confused by being rediected to a site that looks completely different. | ||
+ | * Many SPs are not open to all IdPs in the federation because the SP operators only collaborate with a few home organizations. It can thus be misleading if users of other institutions can select their home organisation although they cannot log in to the service. With an Embedded Discovery Service, SP operators can filter the IdP list accordingly. Therefore, we recommend to run an EDS for Service Providers working with a limited amount of IdPs. | ||
+ | |||
+ | Shibboleth SP comes with a Discovery Service: Shibboleth EDS. The configuration is described on the [[de: | ||
+ | |||
+ | ===== WAYFless URLs ===== | ||
+ | |||
+ | Die harte Verdrahtung des SP mit einem bestimmten ist streng genommen kein IdP-Feature, | ||
+ | |||
+ | Die Konfiguration von WAYFless URLs ist häufig SP-spezifisch. Ob WAYFless URLs für einen Anbieter möglich sind und wie diese URLs aussehen, hängt davon ab, wie der Anbieter den föderierten Loginprozess implementiert hat. Uns sind folgende Best Practice-Empfehlungen bekannt: | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | |||
+ | Einige Anbieter haben dokumentiert, | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | * [[https:// | ||
+ | |||
+ | ==== Konfiguration am Shibboleth SP ==== | ||
+ | Bei einem Shibboleth SP hat ein WAYFless URL in der Regel die Form: | ||
+ | |||
+ | https://< | ||
+ | |||
+ | wobei ''< | ||
+ | |||
+ | ==== Konfiguration in SimpleSAMLphp ==== | ||
+ | Bei simpleSAMLphp sieht ein solcher URL standardmäßig wie folgt aus: | ||
+ | |||
+ | https://< | ||
+ | |||
+ | wobei ''< | ||
+ | |||
+ | {{tag> |