importing SP metadata

[Michael A Grady]

The SP now has the feature of having a "metadata directory" where one can manage separate files. The IdP doesn't have this yet. One idea I've suggested to some in the past is to manage each file separately in such a directory, but have a script program that runs regularly and aggregates all those individual files into a single "partners metadata file", with just that latter listed in the relying-party.xml file (or similar file on the SP). That script can either test each individual file, or just the aggregated file, against the metadata schema for validity before copying into either the versioning repository or the production copy of the file. That script would wrap the individual files with the EntitiesDescriptor element when writing out the aggregated file. Such is easy to do with any scripting language, I wrote a sample in Perl.

On Oct 23, 2012, at 11:04 AM, Christopher Bongaarts wrote:

> On 10/23/2012 6:43 AM, Peter Schober wrote:
>> * Kevin P. Foote <kpfoote at iup.edu> [2012-10-23 04:57]:
>>> Generally speaking though, you adjust your relying-party.xml file to
>>> pick up the new metadata.
>> 
>> I'd advise against that.
> 
> For small numbers of SPs, it's not a bad way to go, provided that you 
> add "from local files" to the end of that (or "validated by signatures" 
> but I think we're looking for simplest approaches here).
> 
> For larger numbers of SPs, or in situations where you have frequent 
> updates/additions to metadata, it typically makes more sense to combine 
> the metadata files into a single file (wrapped with 
> <EntitiesDescriptor>) so you don't have to touch the relying-party.xml 
> file so much.
> -- 
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.