SP MetadataProvider Precedence

[Albert Uwin]

Hi,

I have an IdP metadata in the federation. A new IdP with the same entityID
was install. So the new IdP metadata has the same entityID, but different
certificates, different SingleSignOnService locations.

Before I publish the new IdP metadata in the federation. I'd like to test
it with one of the Service Providers. The SP shibboleth2.xml Metadata
Provider config:

<MetadataProvider type="Chaining" precedence="first">
    <MetadataProvider type="XML" validate="true"
path="new-idp-metadata.xml"/>
    <MetadataProvider type="XML" url="https://federation.org/metadata.xml"
<https://federation.org/metadata.xml> backingFilePath="fedmetadata.xml"/>
</MetadataProvider>

This experiment seems to work. The new-idp-metadata.xml is taking effect
with the above config. The old metadata in the federation is taking effect
with the following config.

<MetadataProvider type="Chaining" precedence="first">
    <MetadataProvider type="XML" url="https://federation.org/metadata.xml"
<https://federation.org/metadata.xml> backingFilePath="fedmetadata.xml"/>
    <MetadataProvider type="XML" validate="true"
path="new-idp-metadata.xml"/>
</MetadataProvider>


But I am confused by the warning in the document:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider

While there is some limited capability for controlling the handling of
duplicate entities, it is explicitly *NOT* supported for a single entityID to
appear more than once with the same valid role, and the software will
*NOT* behave
predictably in such a case. In other words, if the same entity supports a
given role, its metadata *MUST* be identical in all chained sources.


Thank you very much.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171219/6fe5654d/attachment.html>