<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 10/25/2019 5:50 AM, Peter Schober
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20191025105009.ftw7bj37wwun4jk6@aco.net">
<pre class="moz-quote-pre" wrap="">* Dennis Fazekas <a class="moz-txt-link-rfc2396E" href="mailto:Dennis_Fazekas@SHI.com" moz-do-not-send="true"><Dennis_Fazekas@SHI.com></a> [2019-10-25 00:32]:
</pre>
<blockquote type="cite" style="color: #000066;">
<pre class="moz-quote-pre" wrap="">We have customers that want to setup their IDP software to query us
on an interval similar to how the SP can query them using the
MetadataProvider.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">They can. Just know that automatically (i.e., blindly) loading and
trusting cryptographic key material over the Internet is essentially
security theater.
Even if your trust in browser-/OS vendor-supplied web PKIX is
unfailing you'd have to closely inspect the whole HTTP + TLS software
stack in use that's downloading the metadata (so this would need to
happen at every IDP that loads your metadata that way) to account for
any and all degradations in trustworthiness of the connection that may
happen at any time (attacks local to the IDP, local to the SP or
somewhere in the middle), i.e., the things a graphical browser would
signal with UI elements or forced interstitial warning pages.</pre>
</blockquote>
<p>I don't think that aspect (breaking TLS to divert metadata
retriveal) is as much as a threat in this case as that you would
have to take steps to ensure that the metadata provided by one SP
doesn't step on some other SP's metadata. You may be able to work
around the latter problem by using a PredicateMetadataFilter to
restrict the entity ID(s) that can be included.<br>
</p>
<blockquote type="cite"
cite="mid:20191025105009.ftw7bj37wwun4jk6@aco.net">
<pre class="moz-quote-pre" wrap="">We should probably write all this up on a wiki page and put the URL to
that page into that warning message, though.</pre>
</blockquote>
<p>Agreed; now that (as of 3.4) there is a way to work around the
above problem, seems like it might be worth documenting....
Perhaps someone who has done this (I have not yet) could do so (it
is a wiki after all).<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>