LocalDynamicMetadataProvider at the SP

[Peter Schober]

Venturing even futher off-topic:

* Nate Klingenstein <ndk at signet.id> [2019-08-08 09:43]:
> I argued back in the very early days of Shibboleth that metadata
> should be referenced by special DNS records(like MX).  That one got
> shot down very quickly by the actual practitioners who had to deal
> with their DNS administrators and actual applications -- I was still
> just taking notes -- but I still see advantages to the solution.

With DNSSEC and DANE there would be a real chance to put
cryprographically signed metadata (keys, endpoints, cf. SRV records
for XMPP etc) into a scalable directory service but I'm not holding my
breath, either.

Of course large parts of the world (or percentages of DNS zones) are
not ready yet for DNSSEC/DANE so building federations purely on DNS is
the kind of (failed) system design that only works if everyone did it
so it never even gets started.

The fact that DNS itself is now partially redone to work on top of
HTTPS (DoH) I guess you could just as well use HTTPS straight away (as
we're doing today), without putting stuff into DNS first and then
wrapping the DNS wire format into HTTPS protocol messages.

Avoiding having to configure a metadata oracle is a very small gain
compared to the effort it would take to move everything we have in XML
documents today into DNS.

-peter