SP-SP (or IdP-IdP) metadata exchange?

[Cantor, Scott]

On 7/17/12 6:46 PM, "Don Faulkner" <donf at uark.edu> wrote:
>
>Two similar questions:
>
>Is there ever a reason for two or more SP systems to need to have
>knowledge of each other?
>Is there ever a reason for two or more IdP systems to need to have
>knowledge of each other?

Not generally.

>I ask because I'm building the tools that construct our campus metadata
>as a campus-wide "mini federation." I've read at least one web page (I
>think out of nordu.net) that described building separate metadata files
>for the IdP and SP systems in the federation.
> I guess that makes some sense for a large federation, but for a campus
>with one IdP, I don't see a reason to do it.

Your campus SPs only need to know about your IdP. The metadata for your
SPs can be automated and generated and handled entirely internal to your
operations and is really of no interest to anything outside your IdP.

> That leaves me with a couple of options:
>
>1. Put all SP metadata into a EntitiesDescriptor, have the IdP load that
>periodically. Have all SP load the IdP metadata only.

That's the appropriate way.

>2. Put all metadata (IdP + multiple SP) into a single file and have all
>systems load that periodically.

That isn't of any particular use.

>I asked my original question because I wasn't sure if SP's (or IdP's)
>ever directly communicate with each other, or if it's always SP<=>IdP. I
>can think of good reasons for SP's to be able to, but I'm not sure if the
>protocol supports it.

An SP is a role, not a physical construct. Unless there's a profile that
outlines a message exchange between two systems both acting in the role of
relying party, there's nothing that would require such metadata.

-- Scott