Clarification of failFastInitialization Metadata Option

[Tom Scavo]

On Thu, Mar 10, 2016 at 9:54 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> Had
>> your administration committed to making the effort to help this service
>> provider also participate in that same trust federation, I'm virtually
>> positive this fiasco would have been avoided.
>
> Sure, but it's also avoided if the metadata is curated locally, and most often if the vendor won't join, that's your second option.

I strongly agree with that, and that should be the primary take-away
from this thread.

> There really is no scenario in which a vendor actually has metadata, won't join a federation, and could be trusted to maintain the metadata accurately for remote access while honoring the actual purpose of having the metadata refreshed. They'd botch it somehow, be it the way this one did, or by screwing up the key rotation or endpoint changes if they made them by not separating the metadata from the actual change to the system itself, etc.

Joining a federation may or may not decrease the likelihood of Bad
Things from happening. In our federation, IdP operators and SP owners
manage their own metadata, we don't do it for them, and things get
messed up all the time. We provide support where we can but that's not
our primary function. The federation's role is to keep trusted
metadata flowing. By "trusted" I mean integrity protection: we
carefully authorize submitters of metadata and faithfully distribute
that metadata downstream.

> Usually pulling from a vendor remotely means you're directly exposed to an automatically generated metadata instance, and automatic metadata is guaranteed to be wrong simply by definition because of how key management works.

That's true, but the software could implement a workflow that resulted
in trusted metadata at the endpoint. There's no incentive to do that,
however, since today metadata is aggregated at the federation level.

Btw, per-entity metadata will become a forcing function. Initially,
federations will distribute per-entity metadata but I doubt that's the
end game.

Tom