The "Hide From Discovery" entity category is a category of Identity Providers that are intended not to be shown on discovery interfaces by default.
Hide From Discovery Category Specification
InCommon's implementation of the Hide From Discovery Category and the use of the
hide-from-discovery entity attribute (described below) conform to the REFEDS Hide From Discovery Category specification.
hide-from-discovery entity attribute is self-asserted by IdP operators but InCommon Operations may insert the
hide-from-discovery entity attribute into any IdP entity descriptor at its discretion.
By and large, participants register an IdP for one or more of the following reasons:
- To interoperate with providers of commercial vendor services called Sponsored Partners
- To interoperate with Enterprise Services (co-located in the same security domain as the IdP)
- To interoperate with cross-domain Federation Services such as Research & Scholarship Category services and other collaborative services
To interoperate with Sponsored Partners and Enterprise Services, a bilateral arrangement is often needed, whereas cross-domain Federation Services are "promiscuous" in the sense that they are willing and able to interoperate with any IdP. This gives rise to IdP Discovery, a user-driven process (or interface) to discover the federated user's preferred IdP.
An IdP that interoperates solely with Sponsored Partners and/or Enterprise Services may not need (or want) to be exposed on arbitrary discovery interfaces, in which case the IdP should declare the
hide-from-discovery entity attribute in metadata. Federation Services can (and should) filter such IdPs from their discovery interfaces.
Be aware that InCommon Operations reserves the right to insert the
hide-from-discovery entity attribute into any IdP entity descriptor at its discretion. Possible reasons include, but are not limited to:
- The IdP is known not to consume InCommon metadata on a daily basis.
- The IdP is in a domain name that is not public.
- The IdP has endpoints that are behind a firewall.
Declaring the Entity Attribute
An IdP calls out its desire to Hide From Discovery by asserting the following entity attribute in metadata (whitespace added for readability):
To assert the
hide-from-discovery entity attribute in IdP metadata, a Site Administrator logs into the Federation Manager, clicks the "Identity Provider Metadata Wizard," and opts into the Hide From Discovery Category by clicking the appropriate checkbox. See the Federation Manager Release Notes for a snapshot of the Hide From Discovery user interface.
Configure a Shibboleth SP to Filter Hide from Discovery IdPs
To configure an instance of Shibboleth SP 2.5 (and later) to filter on the Hide From Discovery entity attribute, add the following
DiscoveryFilter to your
See the Shibboleth Metadata Config topic for a complete example that includes the above