Windows SP 2.6.0

[Cantor, Scott]

On 6/9/17, 4:19 PM, "users on behalf of Young, Darren" <users-bounces at shibboleth.net on behalf of Darren.Young at chicagobooth.edu> wrote:

> Can I put a copy of that file in Puppet and copy it on disk after the SP
> MSI completes or do I need a fresh one downloaded after install? I¹m
> guessing the former since the SP refreshes it.

The software is meant to manage that material and it's not kosher to do anything manually to it. While it may or may not work, the code isn't written to take into account the possibility that anything that's not the SP is modifying anything in var/cache or var/run.

Knowing what the code does, I can predict what it may or may not do in specific cases, but that flag is turning off the entire basis of the system's security, so the impact of an accident is large.

If you're going to externally manage the metadata out of a concern for performance, you're probably better off loading it from a local file (i.e. out of etc/) and turning off the verification explicitly, and then using a separate mechanism to verify it and push it out via config mgmt. When it changes the SP will reload it, but it will just trust that it's correct because you control who can put it there.

-- Scott