Default Shibboleth SP configuration in packaged distributions

[Jorj Bauer]

Who is responsible for the various vendor distributable packages of shibd?


The default shibboleth2.xml configuration (in the current Debian8 
package, and at least in the installed version of CentOS packages that I 
see on some hosts, although I admit I haven't checked the latest version 
of those packages) has this commented-out stanza:


         <!-- Example of remotely supplied batch of signed metadata. -->
         <!--
         <MetadataProvider type="XML" 
uri="http://federation.org/federation-metadata.xml"
               backingFilePath="federation-metadata.xml" 
reloadInterval="7200">
             <MetadataFilter type="RequireValidUntil" 
maxValidityInterval="2419200"/>
             <MetadataFilter type="Signature" certificate="fedsigner.pem"/>
         </MetadataProvider>
         -->


We've found a vendor that uncommented that in production and were using 
it - until 1/6/2016, when federation.org was apparently registered by 
some new owner, and that URL stopped hosting metadata. Their cached 
metadata expired some time early yesterday and hilarity ensued. [1]

It would make sense to me if that default URL were InCommon's metadata URL:

   http://md.incommon.org/InCommon/InCommon-metadata.xml

... but maybe there's a good reason for it to point to something 
completely broken instead, like

   http://example.org/federation-metadata.xml

-- Jorj



[1] may not have been hilarious.