ShibbolethSP : Dynamic MetadataProviders list

[Cantor, Scott]

On 8/20/14, 11:57 AM, "Paolo de vathaire" <paolodv at free.fr> wrote:
>
>Which tool does testshib use to aggregate Metadata.

It uses the Folder plugin and they touch the main config file every time a
new one is uploaded to refresh it and force it to see the new file. This
falls over once the number of files is large because of refresh behavior
on each metadata file.

> Does the tool provided by John can be trusted enough to be used in
>production ?

Trusted for what? Compared to what?

It is not a 1.0 release and it won't be for a long time. Don't know what
else to tell you. What you're doing here is what federations do. Not using
a federation means you're the federation. That takes work unfortunately.

>ShibbolethSP is working hand to hand with Apache. I use this Apache as a
>load balancer and to authenticate users via Shibboleth.
>Maybe I'm wrong and Shibboleth should be running on each web app that are
>behind the load balancer ?

I'm just saying there are design consequences to separating them. There
are also nasty consequences to clustering on the back-end. But when you
said "doesn't have access", I thought you meant by design, not by choice.
If you wanted to influence or change the config file on the Apache server,
there's nothing stopping you from doing that, other than that it requires
using ssh or something between systems, or sharing file systems. It's not
technically impossible.

>I don't really understand. What would solve my issue would update my
>shibboleth configuration (adding removing MetadataProviders) from distant
>calls.

If you choose to deploy every IdP as a separate metadata provider, then
you will have to edit shibboleth2.xml, period. If you don't want to do
that, then you will have to use a different strategy, and that means
building your own metadata generation platform to aggregate it, using
somebody else's, or writing a plugin.

-- Scott