SP Logout

[Cantor, Scott]

On 9/11/12 5:02 PM, "Yannick Béot" <yannick.beot at gmail.com> wrote:
>
>I just don't get it.
>Why is it a bad idea to use the metadata handler?

For one, it provides no security unless you exchange a signing key for the
metadata out of band. For another, it makes key rollover impossible when
you can't isolate your configuration from the metadata containing the keys
at a given point in time.

>How to you pass SP metadata to the IdP?

That's what federations are for. Alternatively you have to do the same
work.

>I do not want to create it by hand!

I didn't say to. That's why the handler exists, to give you a starting
point. But for the record, creating it by hand is not rocket science, as
the metagen example shell script demonstrates.

-- Scott