metadata generation

[Jeff Masiello]

Ah ok, thanks

Jeff Masiello


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Friday, June 20, 2014 2:55 PM
To: users at shibboleth.net
Subject: Re: metadata generation

* Jeff Masiello <jmasiello at actionet.com> [2014-06-20 20:32]:
> The term Common Federation sort of loses me. In our system, 
> specifically, we have one IdP and multiple SP's from various places 
> and add new SP's randomly. I guess what I'm trying to find is a good 
> common practice to exchange that information that isn't tedious. Our 
> users who install the SP which we supply generally are not super 
> technical.

'Federtion' usually means a Trusted Third Party handling entity registration and metadata management, signing and publishing on behalf if all members. So the concept assumes more than 1 IDP, but some of the tools usef for managing federations might also be useful for large SSO systems with only one IDP. That depends.

You could simply manually import the metadata from each SP, once, and put them into /opt/shibboleth-idp/metadata/local-sp.xml or wherever (and reference that in the IDP's relying-party.xml).

If you want to get fancy you can setup a SAML SP yourself which gives authenticated subjects a self-service interface to register SAML SPs with your IDP. If that's more than a form to dump XML, i.e. you also want to allow SP admins to edit/change their metadata, you'd be looking at a SAML metadata registry software, of which there are a handful but probably all of them will be overkill, unless you'll be dealing with hundreds of SPs.

For the other way round, SPs will need to get a trustworthy copy of your IDP's metadata. As an IDP's metadata doesn't really change (modulo a key rollover every couple of years, if deemed necessary) you probably can get by without signing that, since whether you distribute an unsigned metadata file over a secure channel (once) or whether you distribute the signing key over a secure channel (and then signed metadata via whatever method, including plain http) seems not to make much difference.
If you still wanted to sign the IDP metadata, the contributed XmlSecToo or the SP's 'samlsign' binary are good tools for that.

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net