Documentation of Extensions generated by SP Metadata handler

[Tom Scavo]

On Thu, Mar 5, 2015 at 6:07 PM, James Sanders <sanderjd at gmail.com> wrote:
> I'm curious about the `<md:Extensions>` elements that the automatic Metadata
> handler generates. I'm seeing one underneath `<md:EntityDescriptor>`, which
> contains `<alg:DigestMethod>` and `<alg:SigningMethod>` elements, and one
> under `<md:SPSSODescriptor>`, which contains an `<init:RequestInitiator>`
> element. I'm also seeing a few `<md:EncryptionMethod>` elements under
> `<md:KeyDescriptor>`.
>
> I think I can guess the purpose of all of these, but I can't seem to find
> any documentation about what exactly they are for, or recommendations
> regarding whether or not it's good practice to include them in real
> metadata.

In a bilateral arrangement (between SP and IdP), metadata is shared in
a completely ad hoc fashion so I can't imagine a use for metadata
extensions in that situation. A federation, however, can make good use
of these extension points. As an example, the InCommon Federation (and
numerous other federations worldwide) relies on the following metadata
extensions:

SAML V2.0 Metadata Extension for Entity Attributes (mdattr:)
https://wiki.oasis-open.org/security/SAML2MetadataAttr
SAML V2.0 Metadata Extensions for Login and Discovery User Interface
(mdui:) https://wiki.oasis-open.org/security/SAML2MetadataUI
SAML V2.0 Metadata Extensions for Registration and Publication
Information (mdrpi:)
https://wiki.oasis-open.org/security/SAML2MetadataDRI
SAML 2.0 Metadata Extensions for Shibboleth (shibmd:)
https://wiki.shibboleth.net/confluence/x/QACt

As you can see, the latter is defined by the Shibboleth Project itself
whereas the others come from OASIS.

Tom