<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div>
<blockquote type="cite"><span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 15px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">So
I should, for the IdP, create a location that just has a build MD file and have the SP’s grab that as they spin up?</span></blockquote>
<div><br>
</div>
<div>I would ask SP's to supply metadata to you. If they are not super technical, consider pulling their metadata from their /Shibboleth.sso/Metadata handlers as they register with you and using that as the basis for a pile-of-SP's metadata file on the IdP
node. You could host it for everyone but only the IdP needs to load it.</div>
<div><br>
</div>
<div>all-the-pretty-things.xml:</div>
<div><EntitiesDecriptor Name="allThePrettyThings"></div>
<div> <EntityDescriptor id="SP1" /></div>
<div>
<div> <EntityDescriptor id="SP2" /></div>
<div>
<div> <EntityDescriptor id="SP3" /></div>
</div>
<div></EntitiesDescriptor></div>
<div><br>
</div>
<div>/shibboleth-idp/conf/relying-party.xml:</div>
<div><MetadataProvider id="allThePrettyThings" xsi:type="FilesystemMetadataProvider" metadataFile="/path/to/all-the-pretty-things.xml" /></div>
<div><br>
</div>
<div>There are multiple ways to manage this, from shell scripts or XSLT operating on folders of metadata files to vi to full-blown federation management GUI's with workflows. If this will not change much and you know XML syntax, vi will be fastest.</div>
</div>
<br>
<blockquote type="cite"><span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 15px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">I
guess my next question is, and I haven’t read all the helpful links sent to me yet, is what, if any, are the security ramifications of allowing essentially open access to the metadata file?</span></blockquote>
</div>
<br>
<div>"Open access"? Really bad.</div>
</body>
</html>