IDP metadata in 3.0

[Jacob Lundberg]

On Wed, 2015-01-14 at 20:39 +0000, Cantor, Scott wrote:
> Our official Tomcat support does not extend to version 7 at all

Oh, I did not realize Tomcat 7 had been dropped for the new IdP.  Well,
we should have Tomcat 8 support in Debian 8 in a few more months...

Perhaps large organizations like universities can afford to blow the IT
hours on constantly upgrading Tomcat to get security fixes, but we
really appreciate the effort distributions put into backporting security
fixes so we aren't forced to deal with upgrade fall-out very often when
applying security fixes.  I know this puts us outside the officially
supported area for Shibboleth most of the time but given how much we
modify the IdP that's hardly an issue for us anyway.  Fortunately we
won't be running IdP v3 in our main production operation for a while yet
anyway, because we need to reconcile its new features and code changes
with our own from v2.

I do want to say we really appreciate the effort you put into support,
Scott, particularly when you are answering questions from customers like
us who are not on officially supported platforms.

> I'll see what Tomcat 8 says about it, and if need be we'll change the JSP 
> code.

It's an easy change and now that you reminded me of the correct URL, I
can say the servlet works once the change is made.

> If the V2 documentation mistakenly implies that the latter is supported, 
> we should fix it.

Heh!  I think the documentation is quite clear nobody is supposed to
provide their metadata directly from the IdP.  However in practice it is
also clear many users of the IdP software either do not read the
documentation or do not care.

> I will leave the security implications of consuming metadata like that to 
> you, but suffice to say it requires great care to not end up with a large 
> set of security holes in an SP.

First of all, we push clients to use InCommon.  However, it seems to be
quite difficult to get institutions that aren't already using InCommon
to join.  I suspect we have only successfully motivated perhaps three or
four over the years.

And yes, when consuming metadata from any source besides InCommon, we
filter it to only include the expected entity ID.  We also require valid
SSL certificates, although I suspect this provides very little actual
security benefit.

Thanks,
-Jacob

-- 

Jacob Lundberg
Director, IT Services
jacob at collegenet.com
503.290.0100 (voice)
503.973.5252 (fax)
503.901.8343 (cell)