Should/Can SPs in multiple fed. metadata files use the same entityid for both?

[Cantor, Scott]

On 8/18/11 4:03 PM, "Chris Phillips" <Chris.Phillips at canarie.ca> wrote:
>
>Checked out the archives and poked around the shib wiki and to me it
>looks like an SP that belongs to more than one federation should use the
>Chaining MetadataProvider configuration[1] to have both federations
>metadata available to the SP for evaluation.

The Chaining is optional now, you can put more than one into the file
regardless, but yes.

>The question I have is:
>Can the SP  be present with the same entityID in two (or more)  metadata
>files from different federations provided the entityID record contents
>are identical and used in the identical fashion?

The SP never uses its own metadata, under any circumstances.

>"While there is some limited capability for controlling the handling of
>duplicate entities, it is explicitly NOT supported for a single entityID
>to appear more than once with the same valid role, and the software will
>NOT behave predictably in such a case. In other words, if the same entity
>supports a given role, its metadata MUST be identical in all chained
>sources."

It's referring to IdPs.

>Can someone chime in on what an SP provider should do with their metadata
>to be included in multiple federations and if the Chaining
>Metadataprovider is not the right way, what is the right way?

Essentially, it's irrelevant to the SP (software) how its metadata is
handled. Where it gets very ugly is when you start using different names
with different partners, choosing different keys, etc. Then you better
know exactly how the metadata differs across federations, but you still
don't provide that metadata to the SP itself (or it's ignored when you do).

>Should it be a different entityID per federation metadata file?

Very bad idea.

>Can it be the same entityID for all federation metadata files?

Much better idea.

-- Scott