Metadata security best practices and understanding

[Peter Schober]

* Byte Flinger <byteflinger at gmail.com> [2014-01-27 18:43]:
> We have a Shibboleth IDP which currently talks to one single SP and
> we are using an out-of-band metadata exchange process.
> 
> We are concerned with the speed of revoking such metadata should
> something occur with the signing certificate.

If the metadata is signed you don't need an out-of-band metadata
exchange process and instead could consume the other party's metadata
via e.g. an auto-refreshing HTTP based metadata provider.

The "out-of-band metadata exchange process" then becomes an
"out-of-band signing certificate exchange process", which only has to
happen once, but will allow to sign and verify all future metadata
updates (you'd also include a validUntil in the signed metadata, with
a validity window you find acceptable, cf. "Sign and Expire" in the
URL below).

It's unclear from your post whether you have read this in the
documenation, so I'm guessing not:
https://wiki.shibboleth.net/confluence/display/SHIB2/TrustManagement
-peter