Status of the SP's Metadata Generation Handler

[Cantor, Scott]

On 10/21/15, 12:07 PM, "users on behalf of Sander Maijers" <users-bounces at shibboleth.net on behalf of s.n.maijers at gmail.com> wrote:



>I asked as I'm wondering what Shibboleth developers think of the current status of the Metadata Generation Handler.

I think it was a bad idea that was somewhat necessary, but has caused most of the problems I expected it to cause.

If you're in the tiny minority of people that could use it directly safely, you aren't the audience that the comment is meant for. Just generate it, edit it, and host it however you want to.

>First of all, out-of-band SAML metadata distribution is not by definition secure or more secure than this.

That's called "necessary but not sufficient". Just because "not X" isn't inherently correct doesn't mean "X" becomes the right thing.

> In fact, I've never seen anyone do something close to thorough out-of-band authentication of providers of SAML metadata batches. Out-of-band SAML message integrity checking using signed SAML metadata batches is the main alternative I suppose you're preferring.

Yes, the one that virtually all the federations built predominantly with Shibboleth uses. They don't have to be batches, it works just as well with a query model.

> It follows that using the Metadata Generation Handler does not of necessity lower authentication and/or message integrity security compared to the alternative.

It doesn't follow at all. The alternative is potentially secure, while using the handler is self-assertion of data that should not be trusted via self-assertion. If you want to trust it, that's up to you, but the comment is there to dissuade people from doing something I don't agree with.

>Why?

Because key rollover in this model *requires* a separation of actual configuration from published configuration.

>This wording implies that this metadata has by definition the status of ‘example’ metadata, which does not do justice to the fact that the metadata may in fact have been carefully reviewed and generated from a sufficiently complete template.

In which case, you don't need to be generating it anymore, you can publish the reviwed result.

> Secondly, whether an SP provides it ‘in real time’ is disconnected from the question whether it will be consumed immediately or unchecked by partners.

That doesn't matter for the purposes of the question you're asking.

>What would be missing if you use a complete template?

Possibly nothing, which means you're in the tiny minority of people for whom the comment is only accurate for the other reasons.

-- Scott