Metadata support: Extensions handling

[Cantor, Scott]

On 8/12/13 7:43 PM, "Brent Putman" <putmanb at georgetown.edu> wrote:
>
>Can we always just indiscriminately copy Extensions that appear on an
>EntitiesDescriptor to an EntityDescriptor?  Are there Extensions that,
>semantically, wouldn't make sense to see on an EntityDescriptor, or
>where the meaning or usage would change depending on the context?  I
>haven't thought of a specific example yet, but I have a nagging feeling
>that there might be some...

There certainly could be, but I don't know of any that exist. All the
extensions I've ever defined are either entity level or are group-capable
only as a shorthand, unless I'm forgetting something.

The other way to look at this is if you don't expose EntitiesDescriptor,
then I'm not sure you could meaningfully expose an extension that was
really specific to one.

>Another related point is that XMLObject cloning is somewhat expensive.
>Basically you have to marshall the DOM, if not already there, and then
>unmarshall a new XMLObject tree around it.

Yes, the C++ is more efficient than that, I explicitly require every
object to be cloneable at the field level.

>To complicate matters
>further, in the current metadata processing model we usually eventually
>drop the DOM after it's fetched. So in the lazy processing model (see
>previous thread) where we'd be pushing/pulling the Extensions down at
>caller runtime, we'd be re-marshalling things a lot.  To avoid that we'd
>have to preprocess all the extensions in the document, which is probably
>incredibly expensive if you do wind up cloning them all and the document
>is large (think InCommon or UK Federation's metadata, and all of the
>trust anchors for the PKIX trust model).

That was the main concern I had with this idea. I thought when we
discussed this, we were thinking of having cached extensions that we would
reference in the lower-down objects but not explicitly copy them.
Basically turn them into objects we would attach as annotations, not as
actual XMLObjects. I don't know how well that would work.

I'd still like to have actual numbers to back up the concern though. Most
IdPs at scale run on multi-core systems that can handle some background
cycles.

-- Scott