Shibboleth Developers

[Thomas Lenggenhager <>]

Scott Cantor wrote:
> I don't know. I have a hard time understanding how metadata can be
> self-published without a third party signing it, at which point there's no
> advantage to self-publishing it.

I see a value of self-publishing metadata, even if it has to be signed
by the federations in whom a SP participates.

With self-publishing instead of central management there would not be
the need to have a separate cron job to regularly update the signed
federation metadata file at each IdP (or vice versa for the SPs) in
order to guarantee proper interworking.

If a mechanism like 'modified-since' in http would be used, it would not
be much overhead to check for updated metadata on the fly, especially
when adding a cache with TTL like in DNS.

Thomas