Metadata question for Embedded Discovery and SP authentication of IdP

[Christopher Bongaarts]

Cantor, Scott E. wrote:
>> The problem was that the IdP was calling itself by a different name than
> the metadata that was loaded. It's not mysterious.
> 
> If you have an IdP that's using, say, relying party overrides to assign
> itself a different name, it's only going to work if those relying parties
> don't consume metadata that advertises the IdP with a different name. You
> can load both, of course, but that leads to problems with discovery and
> other problems if the metadata diverges.

FWIW, we do this (use a different entityID with InCommon vs. bilateral 
peers) and have not had problems.  But like you say, you have to be sure 
you don't give your bilateral metadata to consumers of your InCommon 
metadata (which is actually not so bad, as InCommon members are already 
getting it so won't go out of their way to find and import the bilateral 
data).

This is mostly to avoid having to make all our InCommon SPs change their 
references to us from our old urn: style entityID to our URL-based one.
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%