IdP metadata management for non-federated SPs?

[Jim Fox]

The crux of automated SP metadata management is knowing which remote users 
control which SP entities.  Once you have that you're basically home free.

At UW we have a DNS service that tells us which uwnetids 'own' any DNS 
address that we control.  These are generally uw.edu and washington.edu 
addresses. We supplement that with per-domain groups of additional owners. 
This allows non-UW people to participate.

For many years we have operated a self-service SP registry web site, 
where domain owners can register new SPs, edit metadata for existing SPs, 
and request attribute release for them.  The web app stores metadata and 
attribute filters in a database.  To keep it simple it stores the XML text 
for each SP's metadata and filter--not the individual elements and attributes. 
In addition, not every element of metadata is editable--only those parts 
our IdP cares about.

Periodic processes on ech IdP refresh their local copies of the metadata 
and attribute release files from the database. An administrator of a 
new SP (washington.edu or uw.edu) can generally get configured with our 
IdP in less than half an hour.

The only part of this that requires manual intervention is the approval of 
attribute release.

Again, it only works when you have the person-domain ownership problem solved.

Jim



On Fri, 5 Feb 2016, David Gersic wrote:

> Date: Fri, 5 Feb 2016 08:34:55
> From: David Gersic <dgersic at niu.edu>
> To: Shib Users <users at shibboleth.net>
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Re: IdP metadata management for non-federated SPs?
> 
> I've spent most of the last 15 or so years working with XML in several different parts of my job, so working with XML isn't a problem. But thanks, this gives me a few things to investigate (MDA, pyff, testshib's script) when I get time (hah! right...) to do so.
>
>
> ________________________________________
> From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
> Sent: Thursday, February 04, 2016 2:41 PM
> To: Shib Users
> Subject: RE: IdP metadata management for non-federated SPs?
>
>> Then, of course, I have to bounce the Shibboleth service to get it to read the
>> updated files. For a couple of SPs, this isn't too bad. But before this grows out
>> of hand, I'm looking at it and thinking that there has to be a better way.
>
> I wouldn't, and don't, use a separate metadata source for every SP, but even if you did, relying-party.xml can be reloadable anyway.
>
>> Is it really that simple, or am I missing something obvious here?
>
> XML isn't just something you can easily script together out of separate pieces without risking breakage. If you do it by hand, with care, it works ok. And I do that, but I know XML and work with it every day.
>
> If you want to script it, you rapidly run into complexities that are hard to work around without something designed for that purpose.
>
> I don't know how well the MDA software from us fits the local aggregate problem, so I can't say if it's a fit or not.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>