<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Two similar questions:<br>
<br>
Is there ever a reason for two or more SP systems to need to have
knowledge of each other?<br>
Is there ever a reason for two or more IdP systems to need to have
knowledge of each other?<br>
<br>
I ask because I'm building the tools that construct our campus
metadata as a campus-wide "mini federation." I've read at least one
web page (I think out of nordu.net) that described building separate
metadata files for the IdP and SP systems in the federation. I guess
that makes some sense for a large federation, but for a campus with
one IdP, I don't see a reason to do it. That leaves me with a couple
of options:<br>
<br>
1. Put all SP metadata into a EntitiesDescriptor, have the IdP load
that periodically. Have all SP load the IdP metadata only.<br>
2. Put all metadata (IdP + multiple SP) into a single file and have
all systems load that periodically.<br>
<br>
In either case I think the IdP/SP production metadata list will look
like this:<br>
Campus-Local-Metadata (via option 1/2 above),<br>
Non-Federated systems (google, et. al.), as a separate
EntitiesDescriptor, unsigned.<br>
InCommon Federation<br>
Any other federations we peer with (currently only Great Plains)<br>
<br>
I asked my original question because I wasn't sure if SP's (or
IdP's) ever directly communicate with each other, or if it's always
SP<=>IdP. I can think of good reasons for SP's to be able to,
but I'm not sure if the protocol supports it.<br>
<br>
<div class="moz-signature">
<div id="signature-separator" style="line-height:5px; color:
#888;">-- </div>
<div id="sig" style="margin: 6px 0; padding: 8px; border-top: 1px
#000 dashed; font: 12px/15px Tahoma, Geneva, sans-serif;
color:#be0f34;"> <img src="http://goo.gl/2ZYiQ" alt="me"
moz-do-not-send="true" style="float:left; padding: 2px 6px 0
0;" width="43" height="43" border="0"> <span style="color:
black;">Don Faulkner, CISSP</span> | <span><a
onmouseover="this.style.textDecoration = 'none'"
onmouseout="this.style.textDecoration = 'underline'"
style="color:#be0f34;" href="http://its.uark.edu/">IT
Security</a> at the <a
onmouseover="this.style.textDecoration = 'none'"
onmouseout="this.style.textDecoration = 'underline'"
style="color:#be0f34;" href="http://www.uark.edu/">University
of Arkansas</a></span> <br>
<span style="font-family: Monaco, Lucida Sans Typewriter,
monospace; color: black;">contact>> </span><span
style=""><a onmouseover="this.style.textDecoration = 'none'"
onmouseout="this.style.textDecoration = 'underline'"
style="color:#be0f34;" href="mailto:donf@uark.edu">donf@uark.edu</a>
| +1 (479) 575-2905</span> <br>
<span style="font-family: Monaco, Lucida Sans Typewriter,
monospace; color: black;">connect>> </span><span
style=""><a onmouseover="this.style.textDecoration = 'none'"
onmouseout="this.style.textDecoration = 'underline'"
style="color:#be0f34;"
href="http://www.facebook.com/uarkITS">uarkITS on Facebook</a>
| <a onmouseover="this.style.textDecoration = 'none'"
onmouseout="this.style.textDecoration = 'underline'"
style="color:#be0f34;" href="http://twitter.com/uaits">@uaits</a>
| <a onmouseover="this.style.textDecoration = 'none'"
onmouseout="this.style.textDecoration = 'underline'"
style="color:#be0f34;" href="http://twitter.com/dfaulkner">@dfaulkner</a>
</span>
</div>
</div>
</body>
</html>