Registration policy constraint now handles entity types#3
Registration policy constraint now handles entity types#3martin-lindstrom wants to merge 2 commits intomainfrom
Conversation
martin-lindstrom
temporarily deployed
to
github-pages
GitHub Actions
Inactive
Razumain
left a comment
Razumain
left a comment
There was a problem hiding this comment.
Great. But I suggest some clarifications and possibly simplifications.
|
|
||
| ```json= | ||
| - If the subject Entity is the issuer, but not the subject, of the next Entity Statement in the chain, which is therefore a Subordinate Statement, the type is `federation_entity`. | ||
|
|
There was a problem hiding this comment.
I think we could apply some easier language here like:
A Entities in the chain that issue Subordinate Statements of the chain match, and only match, the federation_entity Entity Type in relation to registration policies.
the Leaf Entity of a chain that is represented by an Entity Configuration match the metadata types declared in that Entity Configuration
| - If the subject Entity is both the issuer and the subject of the next Entity Statement in the chain, that statement is an Entity Configuration, and the type, or types, of the subject Entity are the metadata types declared in that Entity Configuration. | ||
|
|
||
| The constraint evaluation process is as follows: | ||
|
|
There was a problem hiding this comment.
Also here I think we could simplify and mention the chaining aspect. That is, that each constraining rule applies to all entity below the subject. Proposal:
"Constraints expressed in a Subordinate Statement applies to all Entities of a chain that are subordinate to the subject of that Subordinate Statement all the way down to the leaf Entity of the chain.
a constraint rule applies to all relevant subordinate Entities where the Entity Type of the constraint rule match the Entity Type of the subordinate Entity."
2 participants
Re-worked how registration policies can be constrained, by re-defining the
registration_policyconstraint.See: https://www.oidc.se/openid-federation-registration-policy/update-constraints.html
Closes #2