Terminology issue

[Scott Cantor]

> What makes our explanation difficult to understand is than most of them still support loading single-entity metadata, so we can't designate the required functionality as "support for XML metadata loading".

Define "most". That's a rare feature, not a common one, and even if they do, they certainly don't support signature verification, proper enforcement of validity, or refresh, so theiir "support" is a joke even if it exists. Cognito is one of the few that handle refresh but they don't do it securely.

> So, excepted a reference to the "Metadata for the OASIS Security
> Assertion Markup Language (SAML) V2.0" specification, is there a non-ambiguous designation for this feature ?

The more critical reference would be to the Metadata Interoperability profile, but I don't recall how much of the details of metadata consumption it covers, I think very little.

I would hope that we did that a bit more clearly in saml2int, so aside from that as a whole, a reference to the metadata sections there might be relevant.

The other aspect of this is simply that "federation" should be defined as seamless use of multiple IdPs (or SPs) at once, but bilateralism. Using the proper definitions helps a lot.

Honestly, about the only thing motivating me to do any work on standards these days is writing documents defining what the vendors don't do, but because so few [1] want to make them angry, nobody is willing to really hold them to account, and so I stopped bothering. Otherwise I'd probably write up something more precise or do another iteration of the IOP spec to cover any gaps.

-- Scott

[1] Few in the US that is, I can't speak for others.