Extending the SP Dynamic Metadata Provider
Rod Widdowson
rdw at steadingsoftware.com
Sat Oct 28 12:00:46 EDT 2017
> In any case, can you explain why artifacts are a nightmare?
In the case when MDQ is being used (and although this is a majority of deployments it is a minority of configurations):
- In the SAML1 case the artifact may not be carrying the SHA1 of the entityID
- In the SAML2 case the use of the SHA1 as the name is only the convention, not the requirement
...But all that an MDQ server understands is the entityID and its SHA1, plus is feels like a slightly weird breech of
protocol-stack to
make such an inference.
In the case where you gave already see the entityID you have the artifact ID cached (save for the SAML2 anomaly) so it mostly just
works
But really, in all the other cases you are DOA.
<Aside>
I know that pragmatically this is all probably not a big deal, but I view it as a matter of professionalism that such edge cases are
exposed, understood and at the very least written into the requirements and thence the documentation. The world doesn't need any
more software which occasionally doesn't work because someone couldn't be bothered getting into the edge cases. It certainly
doesn't seed security (or any other systems) software which occasionally misbehaves.
</Aside>
More information about the dev
mailing list