Back-channel usage

[Cantor, Scott]

On 3/31/16, 7:01 PM, "users on behalf of Baron Fujimoto" <users-bounces at shibboleth.net on behalf of baron at hawaii.edu> wrote:


>
>Yes, in our old/current IdP v2.

Then what's active is whatever you have enabled as RelyingParty profile configurations. Technically, the profiles are "present" based on what's in handler.xml, but if they're not enabled for any RPs, then they're invisible.

All of that is separate from what's in the metadata, that's the main point I was making. Most have all that stuff "on" at some level, but if you don't advertise it in the metadata, it doesn't really matter that much.

>It seems that for the InCommon metadata we provide, we only advertise (if
>I'm getting this right) the SAML2/SOAP/AttributeQuery protocol.

That's unusual, normally if it's only one query endpoint, it would be a SAML 1.1 endpoint for legacy SPs.

>If this metadata represents what we are advertising, then
>the endpoints(?) that the IdP is actually to handle is configured
>elsewhere?

Yes, in handler.xml and relying-party.xml

> Is there any reason to muck the configuration of endpoints
>we don't advertise?

Not a compelling one really but it's always nice to turn things off you don't use. That's more a relying-party thing, just disable the profiles.

>Another of InCommon's upgrade recommendations is to "remove unnecessary
>certificates from metadata". We have the same X509 certificate embedded
>in both an IDPSSODescriptor and AttributeAuthorityDescriptor in our
>metadata. Presumably we at least need the IDPSSODescriptor, but I'm not
>sure what AttributeAuthorityDescriptor is for or whether it's also
>necessary and should be left in place.

An AA role is for attribute queries. It's not an unnecessary certificate, it's either necessary or the role is unnecessary.

I think InCommon's tool just removes the AA role if the query endpoints are removed anyway, it's automatic.

-- Scott