metadata URL?

[Tom Scavo]

Good questions, John.

On Wed, Sep 9, 2015 at 12:38 PM, John Dennis <jdennis at redhat.com> wrote:
> Most SP's and IdP's provide a URL endpoint which allows you to fetch their
> metadata. But how do you know what that URL is?

You don't typically, and you probably don't want to know anyway, since
that is not a recommended approach to obtaining metadata.

> It seems to me this is a
> slightly different than discovery (or is it?).

Metadata has nothing to do with discovery. The latter is a direct
consequence of SP-initiated SSO.

> I have noticed what seems to be a convention with the limited number of SP's
> and IdP's I've dealt with, their entityID is their metadata URL. I don't
> think this is required by any specification. Is it a convention and if so
> does the convention exist to solve the problem of knowing where to fetch the
> metadata from and hence good practice?

This method of metadata acquisition is in fact called out in the OASIS
spec. A better approach is to use the Metadata Query Protocol, [1]
which adds a much-needed layer of indirection.

> Is there some other way in which the metadata URL is published?

Yes, indeed. This is what an identity federation is for. There are
many such SAML federations in the world. InCommon is one.

Hope this helps,

Tom

[1] https://spaces.internet2.edu/x/2w7kAg