metadata generation

[Peter Schober]

* Jeff Masiello <jmasiello at actionet.com> [2014-06-20 20:22]:
> Is that information based on a template and if so can I modify it to
> include things like organization information automatically?

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPHandler#NativeSPHandler-ChildElements

> Is it common practice to allow the IdP retrieve the Metadata from
> the SP via that handler and vice versa or is a manual method
> preferable to exchange that information?

It's not common practice, which is why the content of that resource
starts with this (as you will have seen):

<!--
This is example metadata only. Do *NOT* supply it as is without review,
and do *NOT* provide it in real time to your partners.
 -->

One reason for that is trust: Pulling unsigned XML over the network in
order to bootstrap technical trust in the contained keys and endpoints
requires insight into the https code and trust path validation of the
metadata consumer. Siging (xmldsig) metadata instead of relying on the
transport doesn't suffer from this, at the cost of the metadata
producer learning how to do that and implement it.
The other key rollover, where sometimes you'd like published metadata
to differ from the internal software configuration in key aspects (pun
intended). That could probably be also handled by changing the
software to become aware of what is the old key and what is the new
key, but that's not in the package today.
-peter