Our Info Security folks want a new IDP URL

[Peter Schober]

* Nate Klingenstein <ndk at signet.id> [2018-10-26 23:23]:
> It's a great first step to host a reference copy at the entityID and
> require services to refresh it regularly, but given that not all
> services support metadata, let alone remotely fetching it [...]

There's also the issue of downloading trust anchors (e.g. the IDP's
self-signed certs) blindly over the network and using them to verify
protocol messages.

So that self-hosted metadata better be signed, and if you want an
expiration date on that you'll now also have to sign it regularly,
pushing the expiration into the future.

But if your metadata consumers don't even support metadata, or cannot
refresh it automatically over the network, expecting them to perform
signature validation on that metadata is moot, of course, in which
case signing (and by that, security) is as well.

Yes, having SPs store a snapshot of your metadata locally creates the
maintenance nightmare Stephen now finds himself in. But replacing that
with blindly trusting key material from plain text files,
automatically downloaded over the Internet, seems just as bad, or
possibly worse (as it introduces a 24/7 danger of stuff creeping in,
not just when changes would need to be propagated).

-peter