Shibboleth Developers

["Scott Cantor" <>]

> any chance this could align with the dynamic metadata notions that Ping
> Federate SAML2 server actually supports? ...from an user's email id
entered
> at an RP site, the RP can resolve (openid-style) to a URL at which
endpoint
> the entity's (institutional) metadata can be located...and dynamically
> imported.

The SP already supports this. The IdP kind of does. That isn't precisely
what the feature is referring to. Dynamically generating metadata is
divorced from dynamically consuming it.

> In their concept, trust during that process is managed by SSL/PKI, to
> authorize such auto-import, tho, note. This may not fit well, here. Also,
> would assume the metadata signing tool is complete, and tuned up to easily
> sign a single entities metadata (vs a collection of entity metadata, per
> incommon notions)

All of which the SP already supports.

-- Scott