Discovery Service/WAYF v1.2.1 Shibboleth service provider and simpleSAMLphp - cannot recognize federation metadata

[Peter Schober]

* Coeus[TM] <coeus.ph at gmail.com> [2012-06-06 09:22]:
> > Hard to say, with the complete lack of information you give about the
> > metadata in question (federation name, URL, what you consider
> > incomplete/unusable about it, etc.).
> 
> The federation metadata was incomplete since it only contains Idp entries:
> https://metadata.wayf.dk//birk-idp.xml
> https://testbridge.wayf.dk/saml2/idp/metadata.php

That's something to do with the architecture of WAYF.dk
(hub-and-spoke). But AFAIK they can also expose metadata as if it
where a full mesh federation. You need to talk to WAYF.dk, this is
neither a problem of the CDS nor is there any deficiency in
SimpleSAMLphp.

> compared to this (complete federation metadata) that contains for both
> the Idps and SPs:
> https://www.rediris.es/sir/shibtest1metadata.xml

Which is also a hub-and-spoke style federation (which does not use
SAML but PAPI interenally) but seemingly they expose things
differently.

> Would you be able to suggest what can we use aside from the CDS/WAYF
> where we can still display two list boxes that contains the
> federation names and idps respectively?

Multi-step discovery (1. select your country/federation, 2. selection
your institution) is now generally being frowned upon.  Instead things
like the Shibboleth EDS (or SSP's DiscoJuice) are the recommended
approach. But Rod is the man for all this.

> > I'd also make
> > sure I'd let the SSP people know about it via their own mailing list
> > http://simplesamlphp.org/lists (that of course requires stating
> > clearly what's wrong with the metadata in technical terms),
> 
> I already did. If you may find a time to at least scan the thread:
> http://groups.google.com/group/simplesamlphp/browse_thread/thread/9d170d0d0e8b0d15

I did before posting only checked back a week or so.
Seems Olav (and Ian) explained everything I said above in much more
detail. Not sure what still is unclear.

SimpleSAMLphp and Shibboleth implement software. Federatations
aggregate metadata and publish it in any way they see fit. If you're
having issues with the aggregate with any one federation you'll need
to take that up with that federation. I'm sure WAYF.dk is willing and
able to supply you with something usable with the Shibboleth CDS (if
you're married to that),
-peter