Reason behind comment in Metadata

[Cantor, Scott]

On 10/22/14, 11:47 AM, "Dan McLaughlin" <dmclaughlin at tech-consortium.com>
wrote:

>Can someone with the history/background as to why the comment "and do
>*NOT* provide it in real time to your partners" was added to the SP
>metadata, please explain the reason behind why you would not want to
>provide the Metadata URL to our partners in real-time?
> Is it for security, performance reasons, or other?

There's a laundry list, but the highlights:

- it's meaningless for trust to self-assert metadata, so it's at odds with
the basic model in the software that relies on metadata to secure the
system

- it exposes the consumer if the metadata were ever compromised, which is
a primary reason for using third party certification like InCommon

- it's incomplete metadata, missing useful extensions such as MDUI
information a lot of R&E IdPs rely on

- it makes most of the change coordination and key rollover procedures
associated with metadata impossible because you're tying the metadata to
the configuration instead of using it to document the effective
configuration during changes

Even when none of the others matter, the last is a complete deealbreaker.

-- Scott