Repurpose IndexingObjectStore ?

[Brent Putman]

On 9/23/15 5:07 AM, Rod Widdowson wrote:
>> I guess there are enough cases where entities share certs that it could
>> provide some savings in the IdP on certain metadata sources.

Honestly, I would have thought that, except for some testing scenarios,
not many entities would share certs amongst themselves.  But maybe I'm
wrong.  (unless you meant something else)

> Notably the UKFederation metadata has (had?) many hundreds of IdPs like
> that....

Really?!  I guess I'm missing a whole use case here...


I did think of 2 very common metadata cases though where this
de-duplication really matters:

1) Entities (really RoleDescriptor types) who use the same cert for
both signing and encryption, but express it with 2 distinct
KeyDescriptors with different 'use' attributes.

2) IdPs with both an IDPSSODescriptor and an
AttributeAuthorityDescriptor which uses the same cert


And probably lesser importance/impact:  There are long-lived certs
sitting in metadata, and then you have short-lived signed and encrypted
stuff coming in at runtime in protocol messages, where the message
KeyInfo(s) naturally have certs which are duplicates of the ones
sitting in metadata.  Probably not a lot of impact except on a heavily
loaded IdP with lots of signed/encrypted things coming in
simultaneously with the same cert data.  But might reduce some growth
of the heap and the associated garbage collection.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150923/b02b0424/attachment.html>