Windows SP 2.6.0

[Young, Darren]

>On 6/9/17, 4:19 PM, "users on behalf of Young, Darren"
><users-bounces at shibboleth.net on behalf of Darren.Young at chicagobooth.edu>
>wrote:
>
>> Can I put a copy of that file in Puppet and copy it on disk after the SP
>> MSI completes or do I need a fresh one downloaded after install? I¹m
>> guessing the former since the SP refreshes it.
>
>The software is meant to manage that material and it's not kosher to do
>anything manually to it. While it may or may not work, the code isn't
>written to take into account the possibility that anything that's not the
>SP is modifying anything in var/cache or var/run.
>
>Knowing what the code does, I can predict what it may or may not do in
>specific cases, but that flag is turning off the entire basis of the
>system's security, so the impact of an accident is large.
>
>If you're going to externally manage the metadata out of a concern for
>performance, you're probably better off loading it from a local file
>(i.e. out of etc/) and turning off the verification explicitly, and then
>using a separate mechanism to verify it and push it out via config mgmt.
>When it changes the SP will reload it, but it will just trust that it's
>correct because you control who can put it there.

I’d prefer to leave it so the SP does the work but I don’t think I can
convince anyone to accept a 5 minute startup time.


But that's sort of what I was thinking if this has to be disabled, have
Puppet place the file in var/run after it installs the MSI, make the
changes to the config XML and restart shibd_default. We would have an
external process that downloads/validates the metadata then checks it into
our local SVN for Puppet to distribute. I’d prefer to not do this though.

>