Is it safe to manually alter IDP metadata?

Fabio Spelta fabio.spelta at unimib.it
Tue Jan 15 12:22:05 EST 2013


Hello,
we run a Shibboleth 2 IDP and everything always ran fine with it.

We now put the IdP into a cluster using this approach rather then the
Terracotta one:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering

The sessions are not shared among the IdP nodes. So Shib1.X service
providers are not going to work with this scenario - there isn't any
mean for the SPs to pull attributes from the same node the user
authenticated against. Also, Artifact bindings are not going to work
as documented.
We chose this route because in our federation there is a single Shib
1.X SP left and it is going to be totally dismissed in months. Also,
not a single Artifact binding has been ever used in years.

We would like to clean up our metadata according to this. Is it just
fine to remove any reference like this

<AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://idp.example.org:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>

and this

<ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="https://idp.example.org:8443/idp/profile/SAML2/SOAP/ArtifactResolution"
index="2"/>

from the metadata XML file, then share it with the federation?

Also, is it fine to "manually" include discovery hints (both
geolocation and IP-based) in the metadata as well? Is there any
problem we could incur in?

Many thanks.


More information about the users mailing list