Using MetadataProvider behind web-proxy

[Peter Schober]

* Tim van Dijen via users <users at shibboleth.net> [2023-08-21 11:34]:
> I was able to get this working by using <TransportOption provider="CURL"
> option="10004">myproxy.example.org:8080</TransportOption> inside the
> MetadataProvider-element, but with a couple of dozen providers this becomes
> a bit inept.

Having dozens of MetadataProviders isn't a common case and for secure
operations each of those would also need to include a few
MetadataFilter elements (RequireValidUntil, Signature), maybe also
Include/Exclude/EntityRole, etc., so that an additional line with an
TransportOption element does not to add *significant* overhead?

FWIW, I'm personally managing my SPs' configurations via Ansible (and
Jinja2 templates), that way adding something conditionally or even
static (e.g. shared across all MetadataProvider elements) becomes
trivial.
(Of course noone should have to use additional configuration
management tooling only to the SP's config.)

If your use-case really the aggregation of multiple SAML metadata
documents from many different sources ("a couple of dozen providers")
I'd suggest looking at pyff.io and have that perform any
aggregation. Whether that makes sense for your deployment (or would be
complete overkill) depends on the details, of course.

-peter