ShibbolethSP : Dynamic MetadataProviders list

[Cantor, Scott]

On 8/20/14, 4:36 AM, "Paolo de vathaire" <paolodv at free.fr> wrote:
>
>I have an application where administrators can upload their Idp Metadata
>so we can trust it and allow their users to login.

So does testshib, but there is no effective way to do that today other
than by building or using tools to assemble metadata and updating it
whereever it's being loaded from.

Or you can write a plugin for a new metadata source, which I doubt you
have any interest in doing.

>I saw that in Shib 3.5, I could specify a folder where to look for
>Metadata files but I'm stuck on Debian Squeeze so I'm stuck on Shib 2.3.1
>and anyway Metadata files in this folder are not automatically loaded as
>them are created.

testshib addresses that by triggering a configuration reload, but that
model only works if the number of files in the folder is something
reasonable, it was not designed to handle hundreds of files.

>My application server doesn't have any access to the Apache/Shib server
>so it cannot edit the shibboleth2.xml file.

That is not a model that I design for. The SP is designed to run with
applications, not separately from them.

> I believe it's impossible to specify a distant or even a different path
>for this file unless I rebuild the sources.

If you mean the configuration itself, you can specify it, but unless you
mean a file share or something, that's not going to help you.

-- Scott