configuring metadata for Net+ Box SP

[Nate Klingenstein]

Rob,

> Is this just a simple FilesystemMetadataProvider... something that would look like this?
> 
> <MetadataProvider id="BoxMD" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
>      metadataFile="/opt/shibboleth-idp/metadata/boxmetadata.xml" maintainExpiredMetadata="true" />

Yes, something like that.

> I was also confused... did you have to change something in their provided metadata file and why? I'm not sure I followed that.

Their metadata file has a few curiosities in it and omits a few features we'd like to see, but it should be useable as provided.

You may be thinking of getting metadata about your IdP to Box, which is at this point something that you must do bilaterally with Box must do because of limitations of their federated identity software implementation.

To Doug's message:

> They want to use it as both a username and as an actual e-mail address.
> There are a lot of issues with this.
> Our user's e-mail addresses don't all match the ePPN. Some users have
> multiple e-mail addresses too. Some ePPNs are not e-mail addresses.
> We may reconsider what we send to box.

It's clear that for many universities the concept of email address as identifier is difficult to reconcile with the reality at our disposal.  It may also be remarkably hard for Box to remove the email address as identifier construct.  I hope we will find a point in the middle where they will require a unique identifier and an email address, but treat each as an independent entity, but this really depends on their application.

Active discussion is occurring in MACE-Dir, definers of eduPerson, around whether we can come up with an identifier that will both fit vendors like this and fit campus requirements.

Finally, NET+ wants to have example configuration steps for popular federated identity solutions, like Shibboleth.  If you can compile a step-by-step list of what you had to do, technically, to make it work, that would be great grist for that generic documentation.

Thanks,
Nate.