One IDP to Multiple SPs

[Kuehner, Angela]

I think I understand how to do this now. Question- How does the metadata in the XML file get updated? Do the SPs usually notify us if there is an update? Will I just have to replace the metadata manually in the file\files?

Thanks!

Angela

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, May 30, 2012 11:13 AM
To: users at shibboleth.net
Subject: Re: One IDP to Multiple SPs

Angela,

* Paul Hethmon <paul.hethmon at clareitysecurity.com> [2012-05-30 16:29]:
> Assume you have the following files in your Shibboleth metadata folder:
> 
> local-sp.xml
> third-party-sp.xml
> federation-sp.xml
> 
> All of these will be loaded in the relying-party.xml file. Inside each 
> of those files, you will place metadata for one or more service providers.
> Now if you get a new service provider, you add their metadata to one 
> of those files. Shib will see the timestamp for the file change and reload.

I.e. you would create an (or more than one, as suggested above) XML document (any old text editor will do) that looks something like this:

<?xml version="1.0" encoding="UTF-8"?>
<EntitiesDescriptor
  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
  xmlns:disco="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
  xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
  xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
  xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
  xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" 
  xsi:schemaLocation="urn:oasis:names:tc:SAML:2.0:metadata ../schemas/saml-schema-metadata-2.0.xsd urn:mace:shibboleth:metadata:1.0 ../schemas/shibboleth-metadata-1.0.xsd http://www.w3.org/2000/09/xmldsig# ../schemas/xmldsig-core-schema.xsd"
  Name="https://ju.edu/federation/sps">


</EntitiesDescriptor>

Then, within/between these tags include any <EntityDescriptor> for an SP you want to federate with  (i.e. access them via login to your IdP).
By assigning the surrounding <EntitiesDescriptor> a Name attribute (I made one up for you above) you can later refer to all the SPs included in this <EntitiesDescriptor> by this Name, instead of listing them individually. (I used a URL as the value of the "Name" attribute, see https://wiki.shibboleth.net/confluence/display/SHIB2/EntityNaming for why and alternatives.)

You don't need to start out with three of those files (there's no magic number). Create a single one containing your single SP at first, make sure it's correct (there's a full page on that at https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness ) and get your IdP to load that, instead of the existing file.

Once that works just like before, you can add the second SP to that file (one <EntityDescriptor> after the other, all within the surrounding <EntitiesDescriptor>).
Proceed the same way for any SP where you will have to maintain metadata yourself on behalf of that SP. If useful "groupings" for these SPs emerge (e.g. SPs sharing many policy rules) you could seperate them out into different files and simplyfy your policies to only refer to the Name'd <EntitiesDescriptor> instead. This is fully optional, of course.

What you gain by this (besides a cleaner way to structure your config) is letting the IdP automatically "discover" new SPs (added to those metadata files on-disk) by reloading the existing metadata file(s), without ever touching the relying party configuration.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net