Status of the SP's Metadata Generation Handler

[Peter Schober]

* Sander Maijers <s.n.maijers at gmail.com> [2015-10-21 16:54]:
> What is the reasoning behind the fact that the warning at the top of
> generated SAML metadata produced by the Metadata Generation Handler cannot
> be removed (at least, apparently)?

First and formost, an unsigned SAML Metadata document is just a plain
text file. Noone should be bootstrapping trust in endpoints and
crypographic material (public keys) based on automatically downloading
(and regularly re-downloading) plain text files over the Internet.

Also, this handler mirrors the current software configuration, but
sometimey you need current configuration to be different from
published SAML Metadata. E.g. during key rollover you might want to
configure support for a new key in the software without immediately
publishing that key.

Finally, the provided Metadata will almost certainly be incomplete,
i.e., you will need to add more data to it before publishing.
Stuffing all of that into the SP software only that a built-in
web-server can push it our again does not make a lot of sense.
-peter