Metadata "trust"

[Cantor, Scott]

> I think both Chad and Scott have contributed quite a bit of good
> information on this topic, but also felt the need to throw in my opinion.

Thanks...

> In the SAML SSO world, the trust is established by configuration. If I
> tell my IdP or SP to load metadata with a public certificate in it, I've
> told it to trust it. End of story. What I need to do as an administrator
> is determine how I trust that metadata. Do I download it from a publicly
> accessible site, perhaps protected by SSL (and again that signed
> certificate), do I get the metadata out of band via personal contact with
> the partner? Regardless of how I establish trust, once I have that cert
> (metadata), it doesn't really matter, I have made a decision to trust it.

I certainly agree with all that, but the point I would add is that making that decision isn't a permanent one. Or at least it doesn't have to be, and whether it is or not, and how often the decision is "renewed" *is* a security function, namely how to handle revocation and exposure to compromised keys.

-- Scott