Shibboleth Developers

["Scott Cantor" <>]

> it is not clear to me how to configure a WSP which accept delegated
> assertion from 2 different WSC portals. In particular the "match"
> attribute is not clear...
> 
> Does the rule here below mean "accept portal1 or portal2 as delegate" or
> does it build a delegation chain: "portal1 -> portal2 -> wsp" ?

It means the latter. If you just want to list the allowable delegates, you
just take out match (or set it to anyOrder). That doesn't mean "all these
must be delegates", it means "any of these can be delegates, and nothing
else can be".

To do finer grained checking, there's actually a "Delegation" attribute
extractor that I forgot to document. It can pull off the information that's
in the condition and put it into an attribute, with a value for each
delegate.

-- Scott