Metadata Changeover Questions

[Cantor, Scott]

On 7/22/15, 11:57 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:



>* McKean, Brandon Scott - mckeanbs <mckeanbs at jmu.edu> [2015-07-22 17:45]:
>> Maybe I simply don't understand, but why would there be any breakage
>> at all if SAML1 support is still listed in metadata alongside SAML2
>> support? Does it go back to SP side implementation issues? I
>> suspected SP software would just use what it could from that and
>> things would go smoothly, but I also may be giving it too much
>> credit.
>
>E.g. lesser software may not be expecting attribute names to change
>on-the-wire from SAML1 to SAML2, but your Shib IDP will happily use
>the SAML2 convention (or specification, for MACE-Dir defined
>attributes, i.e., eduPerson) if the SP choses to now send a SAML2
>request to your IDP if it detects the "new" SAML2 support in your
>IDP's metadata.

Yes, that's the most common problem one will run into. There are other edge cases that come up involving XML Encryption and probably a couple others I could come up with if I thought about it.

The point is, it's not necessary. Partial metadata modification as I described to get the protocol constant in without triggering an SP to change protocols lets you push responses to probe for attribute problems in key SPs ahead of a full switch. That's just due diligence.

-- Scott