Metadata Generation

[Cantor, Scott]

On 9/25/14, 6:17 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:
>
>1) About the file itself:  Now that we have separate certificates for
>signing and for the back-channel, does this mean that *both* certs need to
>be listed for the <IDPSSODescriptor>, but only the back channel one for
>the
><AttributeAuthorityDescriptor>? Or do we need both in both places (one for
>any curl negotiations to the backchannel, and the other for SAML
>decoding)?
>Do they both need to be specified as use="signing"?

They need to be in both, there are potential SOAP endpoints in both roles.
Yes, they're both use="signing".

>Is it worthwhile adding an encryption key in as well (even though we don't
>use or configure it).  I would have through not (plus this needs more
>installation mechanism)

We *do* have one now, you may have just overlooked it. And yes, that's
also separate now. It won't be used much, but it's there.

>2) About the IdP Distribution (and so probably for Tom).  Can we move
>example-metadata.xml from src/main/resources/metadata/ to
>src/test/resources/metadata?  It has nothing to do with our distribution -
>it is for an SP and should only be used in tests.

I believe we historically included an example of metadata for an SP, but
you're right, we didn't load it by default. Can the metadata-providers
file be empty safely? I assume so...

-- Scott