Metadata support: Extensions handling

[Brent Putman]

On 8/12/13 7:59 PM, Cantor, Scott wrote:
> There certainly could be, but I don't know of any that exist. All the
> extensions I've ever defined are either entity level or are group-capable
> only as a shorthand, unless I'm forgetting something.

Ok, good to know.


>
> The other way to look at this is if you don't expose EntitiesDescriptor,
> then I'm not sure you could meaningfully expose an extension that was
> really specific to one.

Right, that occurred to me.  Which argues for not necessarily
indiscriminately copying down every Extension. It might have to be
smarter than that.



>>  To avoid that we'd
>> have to preprocess all the extensions in the document, which is probably
>> incredibly expensive if you do wind up cloning them all and the document
>> is large (think InCommon or UK Federation's metadata, and all of the
>> trust anchors for the PKIX trust model).
> That was the main concern I had with this idea. I thought when we
> discussed this, we were thinking of having cached extensions that we would
> reference in the lower-down objects but not explicitly copy them.
> Basically turn them into objects we would attach as annotations, not as
> actual XMLObjects. I don't know how well that would work.

Yeah, I neglected to say that, if we *don't* indiscriminately copy all
Extensions and are more selective, then the trust anchors, etc would be
candidates for not copying down.  Similar to the metadata credential
resolver stuff, the metadata PKIX validation info resolver would just
resolve once from the parent and could cache on the appropriate
EntityDescriptor structure as an "annotation", as you say. 

So that again argues for not blindly copying down every parent Extension.


>
> I'd still like to have actual numbers to back up the concern though. Most
> IdPs at scale run on multi-core systems that can handle some background
> cycles.

That would be nice.  Other than paper-and-pencil guesstimation, I don't
know how to get numbers other than implement it both ways and somehow do
perf metrics.  Which would be a lot of work.

I'd say at the moment I'm warming to the idea of:

1) Doing some upfront pre-processing.  Primarily pre-indexing
EntityDescriptors and EntitiesDescriptor/@Name "tagging", whatever that
looks like.
2) Being selective somehow about parent Extension cloning, and not
blindly doing them all.

I'd be particularly interested in what Ian has to say when he wakes up,
since the UK federation is one of the big ones, and also the metadata
aggregator already deals with some of this kind of thing.