IdP metadata management for non-federated SPs?

[David Gersic]

I've spent most of the last 15 or so years working with XML in several different parts of my job, so working with XML isn't a problem. But thanks, this gives me a few things to investigate (MDA, pyff, testshib's script) when I get time (hah! right...) to do so.


________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, February 04, 2016 2:41 PM
To: Shib Users
Subject: RE: IdP metadata management for non-federated SPs?

> Then, of course, I have to bounce the Shibboleth service to get it to read the
> updated files. For a couple of SPs, this isn't too bad. But before this grows out
> of hand, I'm looking at it and thinking that there has to be a better way.

I wouldn't, and don't, use a separate metadata source for every SP, but even if you did, relying-party.xml can be reloadable anyway.

> Is it really that simple, or am I missing something obvious here?

XML isn't just something you can easily script together out of separate pieces without risking breakage. If you do it by hand, with care, it works ok. And I do that, but I know XML and work with it every day.

If you want to script it, you rapidly run into complexities that are hard to work around without something designed for that purpose.

I don't know how well the MDA software from us fits the local aggregate problem, so I can't say if it's a fit or not.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net