Question on importing/exporting metadata to/from SP

[Peter Schober]

* Michael Nesmith - NOAA Affiliate <michael.nesmith at noaa.gov> [2017-12-19 19:51]:
> The team controlling the Identity Providers have given me two metadata
> files to import into SP.
> 
> sso-dev-cac-idp.xml
> sso-dev-noaaonline-idp.xml
> 
> In /etc/shibboleth2.xml, I have the following set:
> 
>         <!-- Example of locally maintained metadata. -->
>         <!-- 
>         <MetadataProvider type="XML" validate="true"
> file="sso-dev-noaaonline-idp.xml"/>
>         -->
> 
> How do I handle having two files?  Do I just repeat the line and use
> the second file name after "file="?

Well, that's an XML comment, so repeating that wouldn't accomplish
anything. But yes, that's one of many ways to do it. Three other ways
fully under your own control would be:

* Create a file with one EntitiesDescriptor and add any such manually
  managed entities (i.e., EntityDescriptors) as content of that file.

* Use the "Folder" type metadata provider to load all XML files from a
  directory. (Files added later are not considered until a
  reload/restart, though.)

* Use the "Dynamic" metadata provider and put each IDP metadata file
  into a file named after the SHA1 hash of the IDP's entityID.
  (That way new entities will be found without a restart/reload.)

Finally there's the most elegant way, though that involves more than
your local SP installation: Having each of the IDPs and SPs that
need/want to interop join a "Federation" -- e.g. InCommon in the US --
that mediates metadata exchange between all members. Beats any other
method, in every way.

> How do I generate metadata from my SP in order to give it to the
> Identity Provider?

The SP comes with a utility called metagen (as BASH or Batch script;
on Debian/Ubuntu it's called shib-metagen) that does just that.

Alternatively there's also the SP's Metadata handler that produces
SAML Metadata describing the current software configuration. Since you
sometimes want the current (internal ) configuration to differ from
what your partners are seeing that's not without its dangers.

> Does anyone know a good documentation link?

Docs home page for the SP ->
https://wiki.shibboleth.net/confluence/display/SHIB2
"Configure" ->
https://wiki.shibboleth.net/confluence/display/SHIB2/Configuration
"Talk to a New Identity Provider" ->
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddIdP

HTH,
-peter