IDP metadata in 3.0

[Cantor, Scott]

On 1/14/15, 8:16 PM, "Jacob Lundberg" <jacob at collegenet.com> wrote:


>
>For JSPs the code has to pass the JSP engine.  F.e. our Tomcat
>deployments use Jasper, which appears to use the Eclipse JDT as its
>default compiler.  Some versions in Tomcat 7 do not support all Java 7
>features.

Our official Tomcat support does not extend to version 7 at all, so unless 
this affects 8, it wouldn't be an issue other than if somebody chooses to 
document the earlier version.


>  Perhaps this problem may not bite deployments using the
>latest version of Tomcat 7 but organizations like ours prefer to use
>distribution-supported versions of Tomcat instead...

At present, no distributions exist for any of the officially supported 
containers. When that changes, we'll have to make a decision, but my 
personal position is that we should not support any modified distributions 
officially.

>http://tomcat.apache.org/tomcat-7.0-doc/jasper-howto.html
>This page states the default JDK is 1.6 but I tried overriding it with
>1.7 and 7 and it did not resolve the problem.  I will include the
>resulting log output at the bottom of this e-mail.

I'll see what Tomcat 8 says about it, and if need be we'll change the JSP 
code. This is basically an offshoot, I guess, of this whole "run JSP 
without a JDK" concept. I knew that was a bad idea, but I didn't really 
think about why until now.

>OK, good point ... although we have integrations with a lot of
>institutions and based on our configuration I think in V2 the
>non-InCommon institutions who distribute their metadata the "wrong" way
>(directly from the IdP) are about evenly split between /idp/shibboleth
>and /idp/Metadata/SAML

If the V2 documentation mistakenly implies that the latter is supported, 
we should fix it.

I will leave the security implications of consuming metadata like that to 
you, but suffice to say it requires great care to not end up with a large 
set of security holes in an SP.

-- Scott