Understanding flow / federation

[Peter Schober]

* Bo Lorentsen <bl at moch.dk> [2012-09-24 12:22]:
> On 2012-09-24 11:46, Peter Schober wrote:
> > Note that instead of adding a new MetadataProvider for each new
> > Service Provider usually better to collect several EntityDescriptors
> > (SPs) in one file (if you need to aggregate and maintain those
> > entities yourself) and feed that file in a single MetadataProvider to
> > the IdP.
>
> Will this not leave the metadata out of sync ? Not that it matters
> for your own SP's but for idP's in a federation it may be needed.

If there is a federation that provides you with trusted metadata for
all your federation partners none of the above is relevant -- which is
why I clearly stated "if you need to aggregate and maintain those
entities yourself" above (i.e., the conditional doesn't apply).

Even when consuming remote metadata a local copy is created to provide
resilience in case the remote resource is temporatily unavailable.
The IdP software does this for you, if configured.

> > You can then configure that MetadataProvider to automatically
> > reload metadata, without having to restart the container or
> > automatically reload relying-party.xml itself.
>
> This sound nice, no you have an example ?

How about having a look at the documentation? (I won't post links for
you all day so that you don't have to look it up yourself.)
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider
See "About Reloading Metadata Providers" and "File Backed HTTP
Metadata Provider". The minimum config needed would be
MetadataProvider/@maxRefreshDelay if you want more frequent reloading
that the default value (which is specified in the documentation).
-peter