Best Practices for Metadata Management

[Cantor, Scott]

> AFAICT, the primary purpose of this script is to create metadata (hence, its
> name). In any case, I've been working on a complementary script. It uses rsync
> to push files from one directory to another, possibly on different hosts.

I have about three layers of scripts, and metagen is the one at the bottom. I have scripts that batch up calls to it, and then scripts that wrap all those calls in EntitiesDescriptor, and so forth. The dynamic stuff is new so I set that up for the first time when a customer handed me a flat file of 160 hosts.

> I'm trying to get my arms around the rsync command (which I'm not familiar
> with). Can you post the command line you used to sync one sourceDirectory
> with another while you were testing LocalDynamicMetadataProvider on the
> IdP? (Yes, I know you're busy with the SP right now. If this request needs to
> wait, that's fine.)

I'm no rsync expert, but...

rsync -avuC --delete -e ssh /opt/shibboleth-idp/metadata/dynamic/ webauth0:/opt/shibboleth-idp/metadata/dynamic

The interesting one is the flat file consumer:

#! /bin/sh

SRC=/home/shibboleth/etc/engineering-pantheon.txt
KEY=/home/shibboleth/certs/engineering-pantheon.pem
DEST=/home/shibboleth/idp/metadata/dynamic

CMD="/home/shibboleth/sbin/metagen.sh"

ORG="College of Engineering"
URL="http://engineering.osu.edu/"

while IFS= read -r ENTITY;
do
        if [ -z "$ENTITY" ] ; then
                continue;
        fi

        HASHED="$DEST/`echo -n "https://$ENTITY/simplesaml" | sha1sum | awk '{print $1}'`.xml"
        if [ -f $HASHED ] ; then
                echo "Duplicate filename generated for ($ENTITY)"
                continue;
        fi

        $CMD -2 -U -F -T SSP \
                -R eduPersonScopedAffiliation \
                -R OSUID \
                -R departmentNumber \
                -o "$ORG" -u "$URL" \
                -y "College of Engineering Pantheon Hosting" \
                -c $KEY \
                -h $ENTITY \
        > $HASHED 3> /dev/null

        xmllint --noout $HASHED
done < $SRC

The -R options I added to start triggering attribute release rules, but I'm just in my infancy with that. It looks like Unicon is suggesting some standard property names in the GUI to use for triggering attribute release, so once that settles we can get them documented as "reserved" attribute names by the project and cook up some defaults that will work with them.

-- Scott