Turned around on SP metadata

[Cantor, Scott]

>   I'm a little turned around on the SP metadata. I have an install of shibboleth-
> 2.3.8 as my IdP. I want to protect some applications using shibboleth-sp
> (2.5.1). I got everything running against TestShib, which is good.

Metadata is partly configuration tool and partly trust management. Testshib does nothing for the latter, so you're talking about a mocked up scenario vs. real world usage, and those are definitely not the same.

> When I tried
> protecting my applications, though, shibboleth is crapping out. The earliest
> issue is  this warning: 'SPSSODescriptor role metadata for entityID
> 'https://my.shibboleth.server.com/shibboleth' could not be resolved'.

Well, that means the metadata you gave the IdP for the SP is not correct at the moment, at least in one particular respect.

>   I *think* I need to set up a MetadataProvider in the IdP for the SP, as
> detailed here:

Well, you need a metadata source. What that is is up to your deployment strategy. Setting one up for every SP is not all that practical, but most IdPs have local metadata sources for systems that federate with directly. You can put many services into one file. Then there are federations that manage metadata for hundreds of systems and provide it all in one source, and do so securely. Doing itself means you take on the security responsibility.

>Does that seem correct? If so, this is what I have right now in relying-party.xml. I guess I'd add
> a file-backed HTTP metadata provider pointing to my SP?

Asking an SP for its metadata is essentially like asking an anonymous individual on the street if they're trustworthy. It's self-assertion. If that's what you want, you can do that. Or you can establish a trust path out of band with appropriate procedures and then use a signed copy, or there are other approaches.

See TrustManagement in the wiki.

>   Do I need to set up Metadata for the SP as detailed on
> https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP

If you're in charge of the SP, yes.

> I'm a little surprised that the SP doesn't come with metadata already defined,
> but I may be grossly misunderstanding.

The SP can generate example metadata as described in the wiki (/Shibboleth.sso/Metadata). You should not use it directly, it is simply a starting point that can be used to produce an initial document to add to, and sign/manage separately from the SP software. Tying metadata directly to configuration without indirection of some kind makes key management and other operational changes impossible to manage properly.

-- Scott