Project Report: Per-Entity Metadata

Project Update 2015-03-18

  1. In its Phase 2 Recommendations published in January 2014, the Metadata Distribution WG recommended a pilot study of per-entity metadata

  2. An operations team initially deployed a beta instance of a Metadata Query Server in the summer of 2014

    1. The MDQ server sourced (and still sources) both InCommon metadata and eduGAIN metadata

  3. To facilitate the eduGAIN pilot, the beta MDQ server began serving an aggregate of ~1500 IdPs in August 2014

    1. At least six (6) production SPs exported to eduGAIN consume the IdP aggregate served from the beta MDQ server

  4. In September 2014, the Per-Entity Metadata Pilot was publicly announced

  5. Since December 2014, InCommon Ops has been testing IdP interoperability using shell scripts that consume per-entity metadata served from mdq-beta.incommon.org

  6. In conjunction with the public release of Shibboleth IdP V3, the Metadata Query Server began serving per-SP metadata in January 2015

  7. The simpleSAMLphp developers have been testing against mdq-beta.incommon.org since January 2015

  8. The shibboleth.net SPs began consuming per-entity metadata served from mdq-beta.incommon.org since January 2015

  9. On March 18, 2015, an extension of the Per-Entity Metadata Pilot  was announced

Lessons Learned

  1. By virtue of the testing conducted on shibboleth.net, we can conclude that the Shibboleth SP implementation is production-ready for per-entity metadata

  2. Per-entity metadata precludes the need for IdP operators to share “hardcopies” of their IdP metadata with SP partners that do not automatically refresh metadata

  3. Per-entity metadata may give users of “other software” (especially AD FS) added incentive to refresh metadata

  4. The Metadata Query Server could easily support an alternative security model based on TLS (which is thought to be the security model preferred by AD FS)

  5. Per-entity metadata disrupts the current model of IdP discovery

  6. A shell script that consumes per-entity metadata runs an order of magnitude faster than a similar script that consumes an aggregate