Same entity ID in multiple metadata sources

[Nate Klingenstein]

Keith,

> We’re in the process of moving metadata generation to a web-based tool from a manual XML file editing procedure, and we’re trying to make for a clean cut-over. I’m looking for some wisdom of what will happen if the same entityID exists in more than one metadata source. For instance, if we add an SP with our new tool before removing it from the manually edited XML file and the IDP is consuming both the old and new files, will we have a problem? Will it pay attention to the first one it encounters? The one from the newest file? Random, unpredictable behavior?

As you suspect, it's fine to load the same metadata twice.  I believe your guess is correct: the IdP will load the first one it encounters, although it can seem random and unpredictable.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-ChainingMetadataProvider

I have no idea what would happen if one edition of an entityID were modified while the IdP were running.

> In most cases, the metadata from a given entity ID should be the same, so it shouldn’t matter too much, but in the event that we make some type of update while making an addition with the new tool, we want to know what to expect. Relatively easy to test, but hoping for a simple answer from here before we try.

I'd recommend updating both until you complete the transition.  I can't think of any changes that wouldn't be feasible this way, even if the update were asynchronous, unless you need to change metadata really fast.

> Since idp-metadata.xml is listed first in our config, I was assuming that’s why it picked up our current entity ID from the local file rather than the one from InCommon. If so, we’ll just make sure to list the newer source first.

This should consistently work.

Take care,
Nate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121005/a5790172/attachment.html