Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Shibboleth, in its current state, does not offer any tools to import or export SAML metadata. Rather, it consumes the XML directly as a configuration mechanism that enumerates the set of trusted partner sites and tells the software how to communicate securely with them. The !IdP software has support for communicating with "unknown" ! SPs to some degree, as long as the BrowserPOST profile is used. However, there is currently no facility in the !SP for accepting assertions from "unknown" ! IdPs. This will trigger the relatively common "metadata lookup" error.

The ! IdP consumes metadata by looking for entities that act in !SP roles. Conversely, the !SP consumes metadata by looking for entities that act in !IdP roles. In other words, each type of provider needs metadata about its opposite.

At this time (and this is important to note), providers do not configure themselves using their own metadata. That is, an !IdP does not determine how to behave based on metadata about itself, nor does a !an SP. So if you're having problems with your own software's behavior, it's probably not because the metadata you gave it is wrong. But if you're having problems accepting data from or communicating with another site, it may be a metadata problem.

...