Issues NonParticipant using Federation Metadata?

[Tom Scavo]

On Thu, Nov 2, 2017 at 2:31 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
>> On the IDP side, I consume their SP metadata directly (not via InCommon)
>> and the SP entityID.
>
> I would advise against that

+1

> you can't trust people not using InCommon or a similar mechanism to update their metadata in a safe way that won't break. I never consume remote sources from vendors apart from a very rare exception or two where I know they've done key rollovers safely.

I suspect this metadata is auto-generated by their Shibboleth SP,
which means a key rollover will almost certainly not go well.

> If you did do it, you'd better filter it to prevent them from slipping in metadata for a completely different SP than the one you expect.

Yes, definitely. The MDUI elements are also cause for concern since
some IdPs use that info on their login page.

Tom