Error with SPs registered with InCommon

[Michael Grady]

> On Feb 18, 2025, at 11:51 AM, Cantor, Scott via users <users at shibboleth.net> wrote:
> 
>> Dumb question - is it reasonable to replace the old aggregate
>> with the output of the new MDQ aggregates?
> 
> Consuming multiple gigabytes of RAM at this point for no reason is just kind of silly IMHO.
> 
> -- Scott
> 

I've suggested to InCommon before that they publish reliability stats on using MDQ for "just in time" metadata retrieval, to help allay any "fears" folks have from switching to it. But I've not encountered any problems with it in several years, and changing to it is as simple as replacing your current config with something like this. (You might adjust the caching time, or the name of the signing cert file depending on where you put it and what you call it. And unless you have rules in your filter file for release to "any metadata retrieved from InCommon", you won't need the entity attribute added. But it also won't hurt anything.) 

<!-- InCommon Per-Entity Metadata Distribution Service -->
<MetadataProvider id="incommon" xsi:type="DynamicHTTPMetadataProvider"
          maxCacheDuration="PT24H" minCacheDuration="PT10M">
  <!-- 
       Verify the signature on the root element 
       (i.e., the EntityDescriptor element) 
  -->
  <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
          certificateFile="%{idp.home}/credentials/inc-md-cert-mdq.pem" />

  <!-- 
       Require a validUntil XML attribute no more
       than 14 days into the future 
  -->
  <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D" />

  <!-- 
       Add an entity attribute to the entity if you need to "target"
       a filter release rule for "any entity from InCommon MDQ" 
  -->
      <MetadataFilter xsi:type="EntityAttributes">
        <saml:Attribute Name="source_of_metadata">
              <saml:AttributeValue>incommon-mdq</saml:AttributeValue>
        </saml:Attribute>
        <ConditionRef>shibboleth.Conditions.TRUE</ConditionRef>
      </MetadataFilter>

  <!-- 
       The MetadataQueryProtocol element specifies the base URL 
       for the query protocol 
  -->
  <MetadataQueryProtocol>https://mdq.incommon.org/</MetadataQueryProtocol>
</MetadataProvider>

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/d3bcab8b/attachment.htm>