Recommended or "Best" Practices for Shibboleth IdP?

[Mak, Steve]

Don,

> So how do you handle "making" a vendor change their metadata to include 
    a cert for signing and the validUntil setting

With local SP metadata, we can add validUntil manually or enable/disable request signing.

However, we only require request signing in a few scenarios. We generally encourage vendors to not use signing certs unless they have a good reason because FAR too many confuse SAML signing certs with TLS web certs, and insist that SAML signing certs need to be updated yearly.

Generally the requirements for signing are that there must exist something in the SAML request that we want to make sure has not been modified. The primary feature we don't want to be modified is forceAuthn="true" if the sponsor wants to require ignore SSO. If the vendor can't do signing, we simply add a relying party override to turn on forceAuthn.

The only other criteria for required SAML request signing would be wildcard ACS, but we don't have any in use nor have we permitted any SPs to do so yet, but we've planned to require request signing if we ever do allow it.

- Steve