Metadata do not supply to partners?

[Alex Stuart]

> On 26 Jun 2018, at 03:30, Jan Vilhuber <JVilhuber at absolute.com> wrote:
> 
> I found this old thread: https://shibboleth.net/pipermail/users/2013-February/007968.html
> 
> I'm curious why this warning exists. What's the rationale behind it?
> 

The warning doesn't prohibit supplying that metadata to partners. However, it includes two caveats: do not supply it without review; and do not supply in real time to partners.

The draft Interoperability Deployment Profile states "automatic generation of metadata has a strong tendency to undermine the correct functioning of peer deployments in the face of key rollover or changes to endpoints or other software features because it tends to change too suddenly to accommodate a graceful transition between states." [1]

Furthermore, it's difficult for automatic generation of metadata to include all the metadata elements that a relying party might require, such as RequestedAttribute elements, or metadata extensions for user interfaces. And it's impossible to correctly assert entity categories which must be asserted by a third party, such as REFEDS Research & Scholarship [2].

Alex

[1] SAML V2.0 Interoperability Deployment Profile V1.0 (Draft), requirement SDP-MD04
https://kantarainitiative.github.io/SAMLprofiles/saml2int.html

[2] REFEDS Research & Scholarship entity category overview
https://refeds.org/research-and-scholarship


—
Alex Stuart
Principal technical support specialist (UK federation)                
alex.stuart at jisc.ac.uk




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3861 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20180626/d85fe428/attachment.p7s>