configuring metadata for Net+ Box SP

[Cantor, Scott]

On 6/5/13 9:15 AM, "Rob Gorrell" <rwgorrel at uncg.edu> wrote:

>So my question is around the correct setup for the Box SP metadata in my
>IdP?

That's up to you. Most of us use local partner files containing bilateral
metadata for the SPs that we know won't properly give us any operational
control when they make changes. It's going to be all manual anyway, so
storing it locally is by far the best choice.

> Box mentioned something that was new to me... that they did not use
>certificates to sign their metadata as is typical of the shibb world, so
>we would need
> to give the IdP an exception to not worry about unsigned metadata (there
>was some mention they could sign if they had to, but would prefer for us
>to make the exception). Is anyone familiar with this, how to set it up,
>or what the Box metadata should look like?

They will give you the metadata to use, you just can't verify a signature
in your configuration. A local metadata source in a file on the IdP isn't
likely to be signed or verified, it's just loaded and trusted.

How you choose to decide to believe Box' metadata itself, as they supply
it to you, is an out of band issue.

-- Scott