Issues NonParticipant using Federation Metadata?

[Cantor, Scott]

> On the SP side, the SP is consuming InCommon metadata and therefore can
> get our IDPs metadata given our entityID.

There's nothing stopping that, but if they're using Shibboleth or SSP (and a lot of metadata-capable SPs are of course), I tend to get very belligerent about those particular SPs not joining because frankly that's just rude and obnoxious. They have no excuse, and the community is paying for the software they're free riding on.

> On the IDP side, I consume their SP metadata directly (not via InCommon)
> and the SP entityID.

I would advise against that, you can't trust people not using InCommon or a similar mechanism to update their metadata in a safe way that won't break. I never consume remote sources from vendors apart from a very rare exception or two where I know they've done key rollovers safely.

If you did do it, you'd better filter it to prevent them from slipping in metadata for a completely different SP than the one you expect.
 
-- Scott