Metadata Generation

[Rod Widdowson]

>>It did occur to me that idp.properties has all the information needed to
>>do
>>simple metadata configuration 
> If so, that's a happy accident, but that would be useful.

You actually also need the hostname (for URLS and scope), but the installer
has to have this anyway (to generate the entityID and the certificates)
 
> Something akin to what my metagen script in the SP does is probably good
> enough for a start, but in Java code rather than shell.

That makes sense - The V2 Version uses the ant contributions which I'd
sooner avoid.  I'll mock something up either today or tomorrow.  I'll make
it available from the command line and as an ant task.

I have a couple of questions however:

1) About the file itself:  Now that we have separate certificates for
signing and for the back-channel, does this mean that *both* certs need to
be listed for the <IDPSSODescriptor>, but only the back channel one for the
<AttributeAuthorityDescriptor>? Or do we need both in both places (one for
any curl negotiations to the backchannel, and the other for SAML decoding)?
Do they both need to be specified as use="signing"?  

Is it worthwhile adding an encryption key in as well (even though we don't
use or configure it).  I would have through not (plus this needs more
installation mechanism)

2) About the IdP Distribution (and so probably for Tom).  Can we move
example-metadata.xml from src/main/resources/metadata/ to
src/test/resources/metadata?  It has nothing to do with our distribution -
it is for an SP and should only be used in tests.

Rod