Turned around on SP metadata

[Stein, Eric]

Thanks for the pointer. I was able to get it working.

Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, March 18, 2013 4:16 PM
To: Shib Users
Subject: RE: Turned around on SP metadata

>   I'm a little turned around on the SP metadata. I have an install of 
> shibboleth-
> 2.3.8 as my IdP. I want to protect some applications using 
> shibboleth-sp (2.5.1). I got everything running against TestShib, which is good.

Metadata is partly configuration tool and partly trust management. Testshib does nothing for the latter, so you're talking about a mocked up scenario vs. real world usage, and those are definitely not the same.

> When I tried
> protecting my applications, though, shibboleth is crapping out. The 
> earliest issue is  this warning: 'SPSSODescriptor role metadata for 
> entityID 'https://my.shibboleth.server.com/shibboleth' could not be resolved'.

Well, that means the metadata you gave the IdP for the SP is not correct at the moment, at least in one particular respect.

>   I *think* I need to set up a MetadataProvider in the IdP for the SP, 
> as detailed here:

Well, you need a metadata source. What that is is up to your deployment strategy. Setting one up for every SP is not all that practical, but most IdPs have local metadata sources for systems that federate with directly. You can put many services into one file. Then there are federations that manage metadata for hundreds of systems and provide it all in one source, and do so securely. Doing itself means you take on the security responsibility.

>Does that seem correct? If so, this is what I have right now in 
>relying-party.xml. I guess I'd add  a file-backed HTTP metadata provider pointing to my SP?

Asking an SP for its metadata is essentially like asking an anonymous individual on the street if they're trustworthy. It's self-assertion. If that's what you want, you can do that. Or you can establish a trust path out of band with appropriate procedures and then use a signed copy, or there are other approaches.

See TrustManagement in the wiki.

>   Do I need to set up Metadata for the SP as detailed on 
> https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP

If you're in charge of the SP, yes.

> I'm a little surprised that the SP doesn't come with metadata already 
> defined, but I may be grossly misunderstanding.

The SP can generate example metadata as described in the wiki (/Shibboleth.sso/Metadata). You should not use it directly, it is simply a starting point that can be used to produce an initial document to add to, and sign/manage separately from the SP software. Tying metadata directly to configuration without indirection of some kind makes key management and other operational changes impossible to manage properly.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net