Extensibility of SAML 2 metadata

[Keith Hazelton]

Appreciate the info, thanks Scott.

On the question of certs in SAML metadata for client authN over SSL, looking for guidance on how to do that.  I see this page:

https://spaces.internet2.edu/display/InCCollaborate/X.509+Certificates+in+Metadata

and the reference linked from there: 

X.509 Certificates in the Federation Metadata: A technical webinar presented by the InCommon Technical Advisory Committee (October 22, 2009)

Are these the right places to look for detailed how-to info?  

            --Keith
____________________________
On Jun 19, 2012, at 21:37:06, Cantor, Scott wrote:

> On 6/19/12 10:09 PM, "Keith Hazelton" <hazelton at wisc.edu> wrote:
>> 
>> I am trying to determine if some Project Bamboo-specific entity metadata
>> could be folded into a SAML 2 metadata document by
>> specification-compliant extensions.
> 
> This is more of a saml-dev question.
> 
> The rule of thumb is that if you need something to drive behavior between
> two federated systems, it's worth putting in metadata, otherwise there
> really isn't much reason to. Even contact information at this point is a
> questionable value proposition.
> 
> There's nothing in any rule that says what you can or can't put into an
> extension, there's nothing to restrict that.
> 
>> Additional elements might include
>> 
>> - - An additional "ApplicationID" as an alias for the entityID
> 
> I'm not sure what that's supposed to be, but it doesn't sound like a good
> idea.
> 
>> - - A cert for use in client authN over SSL
> 
> Unless you're talking about end users or something, that's already in
> metadata.
> 
>> - - A Bamboo user identifier for the registered author of the
>> application/entity
> 
> That strikes me as one of those questionable things. What purpose does it
> serve? Documentation isn't really the point of metadata.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120620/5dd510b6/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 535 bytes
Desc: This is a digitally signed message part
Url : http://shibboleth.net/pipermail/users/attachments/20120620/5dd510b6/attachment.bin