ShibbolethSP : Dynamic MetadataProviders list

[Paolo de vathaire]

@John

> You might want to look at using the metadata aggregator (
> https://wiki.shibboleth.net/confluence/display/MA1/Home) to combine the
> individual metadata files into s single file wrapped with an
> <EntitiesDescriptor> tag.  That way, the SP only has to load one file.
>

I will take a look at it but the version is not yet final so it shouldn't
be used in a production environment.

@Scott
Thanks for your answers.

> So does testshib, but there is no effective way to do that today other
> than by building or using tools to assemble metadata and updating it
> whereever it's being loaded from.
>

Which tool does testshib use to aggregate Metadata. Does the tool provided
by John can be trusted enough to be used in production ?


That is not a model that I design for. The SP is designed to run with
> applications, not separately from them.
>

ShibbolethSP is working hand to hand with Apache. I use this Apache as a
load balancer and to authenticate users via Shibboleth.
Maybe I'm wrong and Shibboleth should be running on each web app that are
behind the load balancer ?


If you mean the configuration itself, you can specify it, but unless you
> mean a file share or something, that's not going to help you
>

I don't really understand. What would solve my issue would update my
shibboleth configuration (adding removing MetadataProviders) from distant
calls.
The only way I could find since now was editing the shibboleth2.xml file.


Thank you


2014-08-20 16:03 GMT+02:00 Cantor, Scott <cantor.2 at osu.edu>:

> On 8/20/14, 4:36 AM, "Paolo de vathaire" <paolodv at free.fr> wrote:
> >
> >I have an application where administrators can upload their Idp Metadata
> >so we can trust it and allow their users to login.
>
> So does testshib, but there is no effective way to do that today other
> than by building or using tools to assemble metadata and updating it
> whereever it's being loaded from.
>
> Or you can write a plugin for a new metadata source, which I doubt you
> have any interest in doing.
>
> >I saw that in Shib 3.5, I could specify a folder where to look for
> >Metadata files but I'm stuck on Debian Squeeze so I'm stuck on Shib 2.3.1
> >and anyway Metadata files in this folder are not automatically loaded as
> >them are created.
>
> testshib addresses that by triggering a configuration reload, but that
> model only works if the number of files in the folder is something
> reasonable, it was not designed to handle hundreds of files.
>
> >My application server doesn't have any access to the Apache/Shib server
> >so it cannot edit the shibboleth2.xml file.
>
> That is not a model that I design for. The SP is designed to run with
> applications, not separately from them.
>
> > I believe it's impossible to specify a distant or even a different path
> >for this file unless I rebuild the sources.
>
> If you mean the configuration itself, you can specify it, but unless you
> mean a file share or something, that's not going to help you.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140820/e59f7f08/attachment-0001.html