Use of metadata signature filter

[Paul Hethmon]

On 2/14/12 11:49 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:


>> Well, I've been bitten one too many times by partners who give me bad
>> metadata files. I don't really care if they give me garbage values per
>>se,
>> but I definitely don't want Shib to fail because they give me garbage
>>xml.
>> My phone is the one that rings at that point, not theirs.
>
>I'm not aware of any outstanding issues with that, unless it's a batch of
>multiple entities with of course one bad entity breaking the batch and
>preventing it from loading. But the old metadata is preserved and AFAIK
>that's true now across restarts and in pretty much all cases.
>
>Where you can get problems is downloading a file and overwriting your
>copy, and if that file is then bad, you have problems. You need real
>validation code behind any separate maintainer script to prevent that.
>
>

Our normal procedure is to use out of band exchange of metadata. At least
in our usage, the metadata does not change very often at all between us
and our partners. So we don't have a pressing need to dynamically load
metadata looking for changes.

With as much as I've learned here and with as much as I still don't know,
I'm still teaching the real estate industry how to spell SAML too often.
Like the case a couple of days ago where the SP sent my entityID as the
issuer of the AuthnRequest and wondered why they got the no matching end
points error message.

Paul