Is there a checklist for the metadata file?

[Cantor, Scott]

On 3/29/15, 5:17 PM, "Joe Edwards" <joee at uw.edu> wrote:

>I too, would like to figure out what to do to not see:
>'This is example metadata only.
>  Do *NOT* supply it as is without review,...'

Don't use generated metadata directly and you won't see it.

>Is there a checklist to help ensure that all the elements
>required to complete the metadata are included?
>There are many configuration options and files.

The most basic function of the metadata is to name the system and supply the required endpoints and keys. I don't know how to tell you what endpoints you need, because I don't know what you want to do. If you specify a use case, then I can tell you what endpoints are required for that use case.

Metadata should always have contacts in it.

Metadata should usually have UIInfo extensions in it.

SP metadata probably should have NameIDFormat elements in it if the SP requires particular Formats, and it should probably have an AttributeConsumingService in it if it uses Attributes.

Increasingly metadata should probably have SignatureMethod, DigestMethod, and EncryptionMethod specifiers in it.

>I have shibboleth 3.1.1 running satisfactorily,
>I would like to have the best installation possible.

That I can address very directly: you'll have to be patient and spend a lot of time reading SAML specifications once you have some basic experience running it, because there are no books you can read, and no other ways I'm aware of to learn enough about what it's doing.

>Is it possible to have https://myidp.edu/idp/shibboleth
>return a complete metadata file?

The IdP returns whatever metadata is inside metadata/idp-metadata.xml from that location by default. Unlike the SP, it doesn't generate it, it just returns whatever is there.

>If best practice is to review and revise idp-metadata.xml
>and provide that file to SP's, I'll go along with that.

https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement


The best practice is third party trust using federations to provide metadata that follows the "inline" trust model. There are complex security considerations to hosting metadata directly, and it's almost never done well.

-- Scott