hypothetical per-entity metadata question

[Jerry Shipman]

Hello,
Thank you for your help.

The UK fed doc [1] has them (if I'm reading it right) in the opposite order of what I was thinking: first try the file, then if it's not there, try the MDQ server. 
I was thinking to switch the order -- first try the MDQ mechanism, and if that fails for whatever reason, look to see if there is a file.

I think (from reading Scott's page [2]) I can accomplish that by just reversing the order of those two stanzas in the "chain". Is that right?

I'm thinking something like:
 - do that config (i.e. [1] with the order flipped)
 - have a cron job pre-fetch the metadata of some list of "important" SPs to files-on-disk daily (or whatever) (with some logic to leave the old file intact if this fetch fails for some reason)
 - make sure the timeouts on the MDQ operation are short enough (3s?) that the user won't gouge his eyes out waiting for it to fail over

Does that sound like it would work?
Does the IdP validate the signature on the metadata when it reads it from a file? or is it important to do that before writing the file?

(FWIW I agree that it seems unlikely to come up. But I was asked about it and want to have some kind of answer.)

Thanks again,
Jerry


[1] from https://www.ukfederation.org.uk/content/Documents/MDQ ...
<!-- Pre-fetches metadata for the UKf Test IdP, entityID https://test-idp.ukfederation.org.uk/idp/shibboleth -->
        <MetadataProvider type="XML" validate="true"
              uri="http://mdq.ukfederation.org.uk/entities/https:%2F%2Ftest-idp.ukfederation.org.uk%2Fidp%2Fshibboleth"
              backingFilePath="/var/cache/shibboleth/ukf-uk002386.xml" reloadInterval="7200">
            <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
            <MetadataFilter type="Signature" certificate="ukfederation-mdq.pem"/>
        </MetadataProvider>

        <!-- UKf MDQ service -->
        <MetadataProvider type="Dynamic" ignoreTransport="true">
                <Subst>http://mdq.ukfederation.org.uk/entities/$entityID</Subst>
                <MetadataFilter type="RequireValidUntil" maxValidityInterval="2592000"/>
                <MetadataFilter type="Signature" certificate="ukfederation-mdq.pem"/>
        </MetadataProvider>

[2] https://wiki.shibboleth.net/confluence/display/IDP30/DynamicHTTPMetadataProvider