SAMLtest.id Updates

[Nate Klingenstein]

All,

First, thank you for your usage of SAMLtest.  There are over 1200 registered entities today and the number continues to grow quickly.  I hope you've found it useful and we remain eager to respond to your ideas for improvements.

Public service announcements:

   *  Please DO NOT abuse SAMLtest.  An organization was sending AuthnRequests every 10 seconds, which spammed the IdP logs and made it nearly impossible for other testers to use the service.  The organization responsible did not respond to my emails, so I had to block their IP range at ingress.
   *  Metadata was uploaded that matched the entityID of SAMLtest's own providers.  While this caused no problems for testers, it caused some internal confusion.  The upload script now prevents this.

Updates:

  * Uploaded metadata is now validated against more schemas for various extensions that have been added to SAML 2.0.
  * When uploaded metadata fails schema validation, the metadata upload script now displays, via xmllint, what is wrong.  This validation is performed directly against the SAML 2.0 schemas, so in some ways it doesn't match the ruleset used by the Shibboleth IdP and SP, which themselves differ slightly as well(e.g. checking that entityID's are valid URI's).  This is pretty raw and requires some understanding of what constitutes valid metadata, but at least it will tell you precisely what went wrong.

Current roadmap:

  * The metadata upload script will check ValidUntil on submission and reject metadata that has already expired and output a brief warning for metadata that will expire within a couple months.
  * On the metadata download page, I'll list the attributes sent by the SAMLtest IdP and displayed by the SAMLtest SP on the main success page.  This will not be a complete list of the attributes the SP accepts, and you can certainly still send any attribute you want; you will still need to check the SAMLtest SP logs to verify that these attributes are in your assertions as intended.
  * I'll add better error output to the upload script so that submissions that are broken in some way(e.g. validation fails, a URL doesn't contain a metadata, are too large, etc.) will result in more intelligible error messages for beginners than raw xmllint output or PHP errors.  This will take me awhile since there is a wide variety of error conditions and places I need to handle them.
  * I'll finally get around to signing the SAMLtest providers' own metadata and publish the verification keys on a separate server.  I'm sorry this has taken so long.

Much of the roadmap is directly from the ideas of testers, and I'm very thankful for all of your input.  I'll send updates as roadmap items are completed.

Take care and have a great weekend,
Nate.