InCommon Metadata Services
As a prerequisite to trusted exchange of identity information between Identity Providers (IdPs) and Service Providers (SPs), those IdPs and SPs must be introduced to each other in a trusted manner to exchange information about organizational identities and designated contacts, certifications that have been achieved, technical information to enable interoperation, public keys to authenticate information exchanges, information to improve user experience, and the organization (e.g., InCommon) that performed the introduction.
InCommon metadata is the basis for trust and interoperability within the InCommon Federationregistry of those trusted introductions. In a very real sense, SAML metadata powers the Federation. Without metadata, trusted operations would grind to a halt.
Put another way, SAML metadata represents the trust backbone of the InCommon Federation. Within the federation, trust is based on what effectively is a SAML-based Public Key Infrastructure (PKI) built on top of trusted SAML metadata. (This is not to be confused with the more traditional notion of an X.509 certificate-based PKI.)
| Info |
|---|
Trusted metadata makes multilateral federation possible. |
Federation participants trust InCommon to vet the metadata content submitted by other participants. In turn, InCommon vouches for the integrity of the metadata it makes available to participants. This implicit trust agreement As part of their compliance with the InCommon Participation Agreement, Participants provide accurate metadata for their IdPs and SPs. InCommon reviews that information for validity and publishes it as that registry. This process underlies and strengthens the security of the SAML protocol exchanges used throughout the Federationfederation.
Metadata Format
InCommon metadata conforms to the OASIS SAML V2.0 Metadata specification and is schema-valid against the OASIS SAML V2.0 Metadata schema, which is an XML Schema. A handful of extension schema published by OASIS are supported as well.
...