Is there a checklist for the metadata file?

[Joe Edwards]

I appreciate the clear answer. I understand better now.
To paraphase Scott, I have lots more to learn.

I manage the pubcookie server for our organization.
We need to move to shibboleth. Now, that I have shibboleth
3.1.1 working on our dev and test servers, I need to get
to the next level.

Now, to learn enough to get our future production shibboleth
server joined to a federation.

Thanks again!
Joe Edwards
UWMC, ITS, Senior Computer Specialist


On Sun, 29 Mar 2015, Tom Scavo wrote:
> On Sun, Mar 29, 2015 at 5:17 PM, Joe Edwards <joee at uw.edu> wrote:
>>
>> 'This is example metadata only.
>>   Do *NOT* supply it as is without review,...'
>>
>> Is there a checklist to help ensure that all the elements
>> required to complete the metadata are included?
>
> I've been trying to squash this PoV for the last six months or so, but
> without much luck. Your metadata file should not mirror your
> deployment, it should tell your SP partner how you want to
> interoperate with it. Most published metadata files expose way too
> many possibilities, all which need to be interoperable and secure.
> Pick the bare minimum and go with that.
>
>> Is it possible to have https://myidp.edu/idp/shibboleth
>> return a complete metadata file?
>
> That's exactly what you don't want to do.
>
>> If best practice is to review and revise idp-metadata.xml
>> and provide that file to SP's, I'll go along with that.
>
> Well, if you're sharing metadata files bilaterally, frankly you're
> doing it wrong. Either join a federation, or if that's not possible,
> publish your file at a well-known location. Something like
> https://reep.refeds.org/ might be better than trying to maintain a
> location yourself (which has security implications).
>
> Tom