v3.3.1 MetadataProvider, metadataURL formatting question

[Cantor, Scott]

What I'm saying is, if you can't use a proper federation as a middle man and expect the SP will behave appropriately, manual loading of metadata you control is almost always the alternative.

Instructure, for example, gave everybody the terrors when they just rolled their key, but they committed to use of InCommon, and in the end they used it correctly and it worked.

My experience is that vendors giving you metadata sources aren't ones you can trust to get it right. At the least, it's very, very hard to predict.

Secondarily, it means scaling the juggling of trust anchors up to handling one for each remote source and implementing rules to make sure you don't get metadata from a source for an entity other than the one you expect. None of these additional steps is obvious to a novice. And usually people just ignore it. That will become more and more dangerous as we try and use metadata to drive more and more of the system's behavior to help avoid the work people want to avoid.

-- Scott