prefeth-entity-with-shib-in-preview-mdq

You may wish to pre-fetch one or more entities to help mitigate any risk that the MDQ service is down. For example, if your SP primarily only interacts with one IdP in the federation, you could pre-fetch that IdP's metadata and fall back on MDQ for any other IdPs that may occasionally be used. Provided below are examples for configuring both a Shibboleth SP and a Shibboleth IdP to fetch some metadata.

For an added layer of local caching of per-entity metadata, you may wish to deploy one or more instances of the MDQ Signing Container (this is the same container that InCommon uses as the basis for this service). Configuration of that container is outside the scope of this documentation. If you choose to deploy a local MDQ service, please be aware that:

1. Unless your local deployment of the signing container is at least as available as the commercial CDN that InCommon uses for the MDQ service, you may introduce an availability problem for your metadata clients.
2. The signing container will generate its own key and re-sign InCommon metadata using that key. If you deploy multiple instances of the container, you should configure them to all use the same signing key. You would then need to configure your metadata clients to use your local MDQ service and verify the signature on metadata using it's signing key rather than InCommon's

Shibboleth SP Example

<!-- Pre-fetches metadata for the Internet2 IdP -->
<MetadataProvider type="XML" validate="true" uri="https://mdq-preview.incommon.org/entities/urn:mace:incommon:internet2.edu" backingFilePath="internet2-idp.xml" reloadInterval="3600">

    <MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
    <MetadataFilter type="Signature" certificate="incommon-mdq.pem"/>

</MetadataProvider>

<!-- InCommon Per-Entity Metadata Distribution Service -->
<MetadataProvider type="Dynamic" ignoreTransport="true">
    <Subst>https://mdq-preview.incommon.org/entities/$entityID>
    <MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
    <MetadataFilter type="Signature" certificate="incommon-mdq.pem"/>
</MetadataProvider>

Shibboleth IdP Example

<!-- Pre-fetch metadata for TIER Testbed SP -->
<MetadataProvider id="tier-testbed-sp" xsi:type="FileBackedHTTPMetadataProvider"

     metadataURL="https://mdq-preview.incommon.org/entities/https:%2F%2Ftestbed.tier.internet2.edu%2Fshibboleth"
     backingFile="%{idp.home}/metadata/tier-testbed-sp.xml"
     maxRefreshDelay="PT1H">

    <MetadataFilter xsi:type="SignatureValidation"
        requireSignedRoot="true"
        certificateFile="%{idp.home}/credentials/incommon-mdq.pem" />

    <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D"/>

</MetadataProvider>

<!-- InCommon Per-Entity Metadata Distribution Service -->
<MetadataProvider id="incommon" xsi:type="DynamicHTTPMetadataProvider">
    <!-- Verify the signature on the root element (i.e., the EntityDescriptor element) -->
    <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
        certificateFile="%{idp.home}/credentials/incommon-mdq.pem" />

    <!-- Require a validUntil XML attribute no more than 14 days into the future -->
    <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D" />

    <!-- The MetadataQueryProtocol element specifies the base URL for the query protocol -->
    <MetadataQueryProtocol>https://mdq-preview.incommon.org/>
</MetadataProvider>