Adding SP at metadata to federation at run-time

[Peter Schober]

* Kapil Agarwal <kapil.agarwal at wooqer.com> [2016-06-04 10:34]:
> Now when a new SP (https://newsp.example.com/sp) is added
> dynamically at runtime then I have to open & edit the
> federation-india.xml and write a new entry of this newly added
> SP. Now I will have to run the reload metadata service to update
> metadata.

You could create the metadata programatically based on a database
query or a config file or whatever.
I /think/ the IDP now also supports loading metadata from a directory,
i.e., loading any file in that directory, which could make that
process a bit easier.

It all depends on what info you get from those SPs, in what form(at),
what checks you perform (organisationally, technically), etc.

> Is this a good way of handing addition of new SP at runtime ? I am
> concerned about concurrency issues while writing to federation
> metadata file, IO errors and efficiency. Can this be achieved
> without any file read/writes either by using regex or any other way?

There are no such issues with that approach, whether the IDP loads
metadata from a local file or remotely (preferably signed metadata)
via HTTP.

If all those SPs are actually only virtual hosts on the same system
and they are (or could be) all sharing the entityID and the same key
pair -- i.e., if this is really just one mass-hosting system -- then
the alternative approach to having SAML metadata (and seperate
entityIDs) for each of those vhosts would be configuring the (single)
SP to sign its SAML 2.0 authentication requests and configuring the
IDP to accept signed requests instead of performing endpoint
validation.

If they are fully seperate (in entityIDs, keys, management, ownership,
etc.) you might want to look into some tooling to help with the
registration and management of those entities, e.g. using the PEER[1]
software or Jagger[2].  Should the Shibboleth IDP not yet support
loading individual SAML Metadata files from a directory (check the
documentation) you could wipe up a script to munge these into a single
file (wrapping the EntityDescriptor elements in an EntityDescriptor
element). pyFF[3] can do that (plus a lot more) as will the Shibboleth
MDA software.

HTH,
-peter

[1] https://github.com/Emergya/peer and https://pythonhosted.org/peer/
[2] http://jagger.heanet.ie/
[3] http://pyff.io/