Shibboleth Developers

["Cantor, Scott E." <>]

On 4/20/11 1:32 AM, "Dan McLaughlin" 
<>
wrote:
>It is my finding that as of Shibboleth SP 2.4.2 the default behavior
>of the MetadataGenerator no-longer complies with the GFIPM
>Cryptographic Trust Model requirements:

The metadata generator is a tool to assist in the initial generation of
metadata. It's only obligation is that the results be valid, and nobody
should ever rely on it directly within a production process that doesn't
allow for intervention, because that would prevent safe key rollover,
among other reasons.

It isn't possible for the SP to be compliant or not with a profile on the
basis of what the generator does. It's just not involved, because the SP
doesn't use its own metadata.

-- Scott