IdPv3 and its metadata ?

[Rod Widdowson]

Coming in late here.  I'd love to see proper dynamic metadata generation in
V3, but from a project management point of view it just doesn't feel
feasible to include in V3.0.  I guess all that I would suggest is that we
remember the desirability to provide this long term and do not architect
against it...

> If the published metadata is static (like v2) rather than dynamic
> (like the SP), then is the publishing of that static metadata still
> useful to the federation operator ?

That’s one for Tom, Ian &co, but my instinct is that having statically
generated metadata served up on an endpoint is a bad idea.  It gives people
the impression that the metadata is dynamic when it isn't and it encourages
people to add dynamic metadata providers to their SP without considering the
security implications.  Additionally, if a sysadmin really wants the
metadata served up, they can arrange it.

The only argument I could see in favour of keeping this is backwards
compatibility - I suppose there may be SPs out there that already use the
static metadata provider in IdPV2, and they would need to be changed...

FWIW
/Rod