Access Control Service: Home Realm Discovery (HRD) Gotcha
- by Your DisplayName here!
I really like ACS2. One feature that is very useful is home realm discovery. ACS provides
a Nascar style list as well as discovery based on email addresses. You can take control
of the home realm selection process yourself by downloading the JSON feed or by manually
setting the home realm parameter.
Plenty of options – the only option missing is turning it off…
In other words, when you setup your ACS namespace and realm and register identity
provider, there is no way to keep the list of identity providers secret. An interested
“user” can always retrieve all registered identity provider (using the browser or
download the JSON feed).
This may not be an issue with web identity providers, but when you use ACS to federate
with customers or business partners, you maybe don’t want to disclose that list to
the public (or to other customers). This is an adoption blocker for certain situations.
I hope this feature will be added soon.
In addition I would also like to see a feature I call “home realm aliases”. Some random
string that I can use as a whr parameter instead of using the real issuer URI.
