Metadata security best practices and understanding

[Cantor, Scott]

On 1/27/14, 12:42 PM, "Byte Flinger" <byteflinger at gmail.com> wrote:
>
>Am I correct in this? Am I missing something? I understand that something
>like OCSP check/revocation is not possible with out-of-the-box Shibboleth
>IDP so how would one tackel the issue of quickly revoking a certificate
>should something happen?

Peter addressed this. Metadata exchange is functionally identical to OCSP
in the end, particularly because OCSP involves caching in the end anyway.

>I am thinking that maybe if the side running the SP would setup such a
>metadata provider so they can easily and quickly revoke their own
>metadata supplied to our IDP.

Yes, it just doesn't scale, which is why third party federation exists.
Most federating systems today simply ignore the issue. They may have
thousands of partners, but they punt and just do the same one-time OOB
thing you're seeing as reasonable for 1 case. Which it is, but it's a
slope that you will often slide down in the end.

Do you think that any of the next 10 projects involving federation will
allow you to go back and redo your design to work out a more scalable
approach? If so, kudos, you work for a better enterprise than I do.

Most people get one shot at doing something robust, and that's about it.

> If that would be the case, is there any software out there to do this?
>Could something
> like ADFS (Being run in SP side) already support this without too much
>extra effort?

ADFS serves signed metadata, IIRC, but it derives the metadata from the
configuration, which makes using metadata for key rollover impossible.

Hosting signed metadata doesn't require anything but a web server, it
doesn't need to be supported by any other software.

-- Scott