Multiple Certificate Scenario

[Cantor, Scott]

On 8/27/14, 7:35 PM, "Kristen Judd" <kjudd at iparadigms.com> wrote:
>
>1.  Would this work federation-wide if the federation's entity ID is
>specified for the RelyingParty?

Federations don't have entityIDs (in fact they don't exist in purely SAML
terms). What you're doing is relying on something called "containment"
based on how the metadata is carried around, and that breaks as soon as
less primitive ways of consuming metadata are used.

There aren't any widely deployed/supported ways right now of associating
an entity with something like a federation that is future proof, so you're
baking in a dependency on something that's eventually going to change. We
know how that goes when the time comes to fix it.

>It appears that in the example on the wiki-page for RelyingParty, it
>could work at a Federation level:
>
>   " <RelyingParty Name="SpecialFederation"
>keyName="special.example.org"/> "

That page is sending a bad message but it's a very old page.

What it's doing is referring to an EntitiesDescriptor name. That is not a
federation except by convention, and EntitiesDescriptors have no future
once we stop passing around giant files.

>2. Can anyone explain why the documentation warns against using this
>multiple certificate scenario and what downsides there are?

It's more complex and has no benefits. It makes key rollover even harder
than it already is. Controlling it based on an EntitiesDescriptor is not a
forward-looking strategy, and there are no good alternatives right now. It
breaks in unpredictable ways when an IdP shows up in more than one
metadata source. It creates a scenario in which a system's metadata is
necessarily different depending in who's asking, which is extremely
difficult to manage without making mistakes, and the instant you make a
mistake or somebody else does, users can't log in.

The only reason for doing this is because of misguided policies that need
to be resisted. Usually it's a vendor forcing this kind of thing on
universities, but it's equally wrong when it's happening in the other
direction. The proper response to it is "no".

If it's done in very isolated cases for an IdP or two, it can be carefully
manageable. It is not an isolated case to do this at the level of an
entire federation. That will break, it's just a question of when.

-- Scott