sharing Shibboleth SP configuration data

[Cantor, Scott]

On 10/20/14, 1:27 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:

>I am tasked with documenting our Shibboleth SP configuration so that
>other institutions can replicate our work. What, if any, elements in the
>shibboleth2.xml or attribute-map.xml files should I consider sensitive
>enough to redact before publishing them?

I really don't know what people would consider sensitive. I suppose if
there's anything, knowing what headers you're using might provide somebody
with at least a head start on trying to build an exploit, but since
everybody uses the defaults mostly, that doesn't mean much.

>I assume there is nothing in the SP metadata to worry about. That
>information gets published by InCommon as part of the production metadata
>aggregate, so it's available to anyone with an Internet connection anyway.

Unless you're going to change defaults, nothing in the metadata is going
to be even very difficult for somebody to guess.

-- Scott