Hub-and-spoke federations are characterized by the fact that each connected service provider only recieves attributes from a single entity provider, namely the federation hub. This hub acts as an IdP-proxy on behalf of all connected IdP.
This approach has several advantages:
Simple metadata management for service providers
Service providers only need to keep knowledge (metadata) about a single entity, namely the federation hub (the IdP-proxy). This simplifies the setup and knowledge required to operate a service in a federated environment.
Use of standard attribtue release profiles
Standard attritbute release profiles are profiles suggested by the federation operator. To simplify negotiations all exeptions from the standard profiles must be documented in the contract. Typically this is not a problem as most accept the notion of standard profiles. The discussion is then reduced to a question of difinition of the purpose of the service and deciding on the appropriate attribute profile.
The federation operator has special expertice in the legal setup, good knowledge about the attributes available and more experience in dealing with negotiation of attribute release profiles than most IdPs have or can maintain over time.
Strong negotiation power (SP cannot press individual IdPs)
The federation operator is negotiating the attritbute release profile on behalf of all IdPs and it is in practice impossible for service providers to influence the IdPs individually. As the number of IdPs goes up, the stronger the negotiation position of the federation operator gets.
(No) commercial interest
As the federation operator is not part of the business relation between services and IdP’s, the negotiations stay focused on the issue of balancing the attritbute release profile with the purpose of the service. Based on the principle of minimal disclosure.
Since all services connect to the federation hub, a standard contract may be introduced. If accepted, this lowers the IdPs interest in scrutinizing each contract as requirements and obligations are known to all.
WAYF’s template for describing the ‘purpose of the service’:
WAYF’s standard attribute relase profiles:
Video presentation on attritbute management and ARPs:
which is available at WAYF’s video archive: