No metadata returned for SP with matching protocol

[Wessel, Keith]

Thanks, Mike! I was planning on whipping up a script to do exactly what you suggested. The DB solution is more than we want to do since we already have a federation for all of the campuses, and the DB would essentially be duplicating a good chunk of that functionality.

Amusingly, Mike, many of the SP entries in this file go back to when you ran the IDP here at Illinois. Time for some sanity checking/house cleaning while I undertake this project.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Michael A Grady
Sent: Thursday, January 14, 2016 3:35 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: No metadata returned for SP with matching protocol


> On Jan 14, 2016, at 12:45 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> On a slightly related note, am I correct that there's still no way to 
>> tell the IDP to load metadata from every file in a directory?
> 
> No.
> 
>> If this isn't available on the IDP (I've seen that it is on the SP 
>> now), I assume there's a good reason for that.
> 
> No, there's a half-assed version in the SP. It doesn't monitor the directory so it doesn't see new files or get rid of deleted ones, which IMHO is a requirement and is non-trivial to build.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net

One thing I had suggested to one client I was working with awhile back was the idea of maintaining a directory of individual files, but then having a script that read all those files in, checking schema validity etc. and outputting a new "aggregate" from those. (And maybe even checking that was valid before replacing the current local aggregate with the updated one.) I had a very simple Perl script for combining all the files wrapped in EntitiesDescriptor, but hadn't added in executing xmllint or xmlsectool on each separate file, just assumed one would do that before adding a new file to the "aggregate directory". I've seen other places that manage it all in a database, and generate a bunch of individual metadata provider entries from the DB. (I.e. auto-generate a metadata-providers file).

--
Michael A. Grady
IAM Architect, Unicon, Inc.