Relying party parsing. Metadata providers

[Cantor, Scott]

On 3/20/14, 10:41 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>I'd like to air a couple of issues which arose today.
>
>- Firstly I noticed that the default for requireValidMetadata in the
>OpenSAML class was false, but the documentation was that it be true.
>Looking at V2 AFAICS it defaults to false there too.  I unthinkingly
>changed
>the default and then realized that I really wanted to air this question
>first.  I also realized that a test was failing as a result.  So I have
>reverted the change for now.  Any thoughts?

Brent would have to comment on why that would default to false in the
code. That seems odd, but FWIW, I really think we want to make sure our
defaults from a config standpoint match the code defaults.

>- I am getting increasingly unhappy at adding referenced to OpenSAML and
>idp-saml-impl to the idp-profile-spring package.  Whereas Security and
>Relyingparty configuration can be thought of as being SAML-neutral,
>metataproviders are pretty SAML specific (although I suppose other
>protocols
>could have metadata...).  Are we comfortable with these dependencies or do
>we want to split the parsing across packages?

I would think it's most sensible to have a SAML module for parsing the
metadata configuratiom, if that really breaks any links from idp-profile-*
to any SAML classes.

-- Scott