Sharing SP Metadata amongst multiple SPs

[Cantor, Scott]

On 11/7/15, 2:00 PM, "users on behalf of Phil Lello" <users-bounces at shibboleth.net on behalf of phil at dunlop-lello.uk> wrote:



>Perhaps I should have specified I'm talking about the AssertionConsumerService in the AuthnRequest from the SP, and whether or not the Shibboleth IdP will respect use value in the request if it isn't present in the metadata the IdP holds for a given SP.

Not unless the request is signed and the IdP is configured to skip validating the endpoint.

The metadata should whenever possible represent what it's meant to: the *services* the IdP is supporting. Sometimes that means a shared key across many EntityDescriptors, and sometimes that means a single EntityDescriptor and lots of endpoints. It just depends. Either way you're not getting out of (quite minimal) work.

Also, whether you control the IdPs fully in a deployment has a lot to do with what's workable.

-- Scott