Issues NonParticipant using Federation Metadata?

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2017-11-02 19:32]:
> > On the IDP side, I consume their SP metadata directly (not via
> > InCommon) and the SP entityID.
> 
> I would advise against that

To add to Scott and Tom:

The way I consume metadata from sources I don't fully trust with
secure/reliable production thereof is getting a snapshot of their
metadata once and use only that (from a local file) in the IDP. Also
commit it to a git repo (or whatever), and then periodically check for
changes (e.g. `curl -sSo vendor.xml $URL`), e.g. with email
notification if it changes (e.g. `git diff --exit-code vendor.xml`
etc.) via cron.

That prevents all kinds of nonsense (such as other stuff sneaking into
the metadata when noone's looking) at the cost of you having to update
your local copy of their metadata once the changes do make sense. Then
commit those changes (to make the diff go away), rise and repeat.

Since you then already have your own local copy why not also amend the
local metadata with some XSLT script each time before diffing (and
before checking in locally), say, if you wanted to move some
configuration items into the metadata itself (e.g. NameIDFOrmat,
RequestedAttribute, MDUI).

Of course not even a local copy (even one kept up to date) won't save
you from the ways an SP could mess up metadata production or key
rollover.

-peter