MetadataForIdP

[Cantor, Scott]

On 8/4/14, 9:33 AM, "Andy Bennett" <andyjpb at knodium.com> wrote:
>
>I'm running a Shibboleth SP and I'm looking through our Metadata feeds
>and it appears that a lot of IDP Entities are advertising strange stuff
>then. Mostly entities that I believe are running Shibboleth IDP software
>are advertising SingleLogout capability and some IDPs that send us
>persistent-ids are only advertising NameID formats for
>urn:mace:shibboleth:1.0:nameIdentifier and
>urn:oasis:names:tc:SAML:2.0:nameid-format:transient

A limited, largely harmful rather than helpful, implementation of logout
exists in 2.4 and lives at a standard endpoint. It will generally return a
Partial logout indicator in general, so it's conforming in that sense.

As for NameID metadata, there's no way for the IdP to know anything about
that, people either supply correct metadata to people or they don't.
That's a human function, not a software function.

-- Scott