Docusign SSO

[John Dennis]

On 11/28/2016 09:36 PM, Peter Schober wrote:
> * Klingenstein, Nate <nklingenstein at calstate.edu> [2016-11-29 03:00]:
>> If I could change one thing in the world, "IdP URL" would mean
>> "entityID" and metadata would be hosted there.  Modern versions of
>> Shibboleth by convention host metadata at /idp/shibboleth, but it's
>> far from consistent, which makes it far from usable in existing
>> large-scale use.
>
> Asking the entity about itself (i.e., provide some text file over the
> Internet with crypographic keys etc.) also provides zero trust, making
> this approach rather pointless -- unless you have solved the problem
> of entity owners hosting their own metadata /signed/ by a trusted
> third party.
> So I wouldn't put any emphasis on pointing anyone or anything to the
> IDP to get it's metadata. You might as well forget it exists (or
> even prevent access to it.)

That seems a bit drastic. Most of the deployments I'm aware of host 
their metadata on an https URL and provided you don't do something silly 
like not requiring TLS or not verifying the server cert I'm perfectly 
comfortable with trusting that metadata.

Do you believe metadata exchange over TLS as insecure?

In addition I don't see much point in adding trusted 3rd parties to sign 
and host metadata given the metadata retrieved from the entity can be 
signed and independently verified.


-- 
John