Auto-reload the relying-party and attribute-Resolver

[Peter Schober]

* David Bantz <dabantz at alaska.edu> [2013-08-08 19:10]:
> Your elaboration on this recommended practice would be appreciated Peter.

This has been described in the archives so is neither new nor my own
creation, jfyi.  Also I don't have any "special needs" SPs at the
moment.  Anyway, the basic idea is to have several metadata providers
configured pointing to local metadata files (which auto-reload
metadata themselfs).  Those local metadata instances are named via
EntitiesDescriptor/@Name, so you can refer to them by that name (a URI
per the spec, e.g. https://example.edu/saml/sp/noencryption).
Additionally you have RelyingParty elements for each category of
"special needs" SPs, which have the required ProfileConfiguration
(e.g. turns off encryption, to keep with the above example) and which
refer to the local metadata "groups" via the URI (the value of your
EntitiesDescriptor/@Name in local metadata files).

All of that is hinted at in the documentation
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPRelyingParty
in the description of the "id" attribute:
"URI of the entity *or* *group* to which this configuration applies"
(my emphasis).

A way to apply ProfileConfiguration to sets of entities without
managing the whole EntityDescriptor locally (i.e., only reference
entityIDs, e.g. in an XRD file?) would make this easier.  Or borrowing
some language from the filter configuration where you can OR entityIDs
together.
-peter