Shibboleth XML Configuration file Validation

[Mark O'Quinn]

Scott, thank you for your response. I have some questions related:

> Couple of thoughts:
> 
> - I wouldn't expect you'd ever touch relying-party.xml if your use case is
> provisioning SPs. That should rarely be needed.

At the moment I'm running some tests with Google Apps and I am provisioning SPs as this document mentions:
https://developers.google.com/google-apps/help/articles/shibboleth2.0 where the SPs are included in the
relying-party.xml, but you said using this file is rarely needed, can you please explain a little more about it?

> There may be interactions between your proposed reaction to a failure and
> the normal way the code deals with preventing corrupt config objects from
> replacing live/working ones. Maybe you're operating at a level that would
> supersede that, I'm not sure.

Well, I'm only catching the ServiceException, if something goes wrong, during the reload 
of the services (using the HttpServletHelper class) I trigger the operation of replacing the
original and valid configuration files for the bad ones (the step 9 of my previous email), but this
is something I want to leave it to Shibboleth, I mean, call the methods and classes Shibboleth uses  
to handle this situation, instead of trying to recover from a failure by copying and replacing the files myself. 

Right now I'm studying the way Shibboleth, like you said, prevents corrupt config objects from replacing 
live/working ones, in order to do this the right way. 

> Right, well, the other feedback is that all the work is in concurrency
> safety.

I'm little confuse here, so I'll explain myself through two examples:

1) Since Shibboleth can be setup to reload the configuration files by time intervals; let's say for example,
that I start working with the files (reading, copying) and precisely in the middle of my operations, Shibboleth 
starts reloading the files (because the time interval matches the time) through the services (HttpServletHelper)
and since Shibboleth puts a Lock, If I didn't put a Lock first, I believe a problem will occur. 

So I'm looking for a way in which I can put a Lock or use Shibboleth to put a Lock in order to prevent 
any problems.

2) I'm designing the provisioning of SPs to be dynamic and that it can be done by multiples users at the same time,
so I working in putting a Lock to prevent concurrency issues.

Can you please elaborate a little more about what you said, taking into account what I have wrote?

> Sounds pretty interesting in general, though. Might be the seeds of a
> service interface we could incorporate or package as an extension and
> would be great code to have as an example.

Great! :) As soon as I can (it might take me some weeks, due to my job) I will create a document where I'll explain everything I have done related to the information
in these e-mails and I'll attach the code.


Thanks again Scott for all your help. I really appreciate the time you and other people take to answer the questions and doubts.

Best Regards!

-Mark










-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120928/db4f9799/attachment.html