Terminology issue

[Guillaume Rousse]

Le 07/11/2025 à 14:27, Scott Cantor a écrit :
> 
>> What makes our explanation difficult to understand is than most of them still support loading single-entity metadata, so we can't designate the required functionality as "support for XML metadata loading".
> 
> Define "most". That's a rare feature, not a common one, and even if they do, they certainly don't support signature verification, proper enforcement of validity, or refresh, so theiir "support" is a joke even if it exists. Cognito is one of the few that handle refresh but they don't do it securely.
The few ones I've heard of are generally able to extract the minimum 
amount of information required from XML metadata (SLO endpoints, 
encryption/signature certificate), instead of having the admin enter 
those information manually. That's enough to give the feeling of "SAML 
metadata support", usually.

>> So, excepted a reference to the "Metadata for the OASIS Security
>> Assertion Markup Language (SAML) V2.0" specification, is there a non-ambiguous designation for this feature ?
> 
> The more critical reference would be to the Metadata Interoperability profile, but I don't recall how much of the details of metadata consumption it covers, I think very little.
> 
> I would hope that we did that a bit more clearly in saml2int, so aside from that as a whole, a reference to the metadata sections there might be relevant.
Thanks, "Metadata Interoperability profile" seems enough for us 
currently. We're not facing RFC specialists, just people failing to 
understand why their SAML-compliant software doesn't qualify with our 
own requirements.

> The other aspect of this is simply that "federation" should be defined as seamless use of multiple IdPs (or SPs) at once, but bilateralism. Using the proper definitions helps a lot.
We usually define "federation" as "delegating trust relationship 
constitution to a third party", not just as a number of trusted 
IdPs/SPs, which seems to match your definition.

Regards.
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4291 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20251112/377aca29/attachment.p7s>