Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
...
| Expand |
|---|
| title | Specific XML Elements |
|---|
|
Name | Cardinality | Description |
|---|
<TLSTrustEngine> | 0 or 1 | A custom TrustEngine used to evaluate TLS server certificates. This element conflicts with and is overridden by the httpClientSecurityParametersRef attribute. It contains a single <security:TrustEngine> element. | <MetadataQueryProtocol> |
0 or 1 | Constructs the metadata request URL based on the requirements of the Metadata Query Protocol | <Template> | Constructs the metadata request URL by means of a simple transform based on substitution | <Regex> | Constructs the metadata request URL by means of a complex transform based on a regular expression |
At most one of the <MetadataQueryProtocol>, <Template>, or <Regex> child elements is allowed. If none are configured, the provider constructs the metadata request URL directly from the entityID. This corresponds to the "well-known location" mechanism defined in the SAML 2.0 Metadata specification, section 4.1. | Warning |
|---|
If you forget to configure a child element, the provider will default to the well-known location strategy. This constrains the entityID to be an URL (not an URN) but the provider does not check the URL scheme. If the scheme on the entityID is "http:", the metadata exchange will be vulnerable to a man-in-the-middle attack. For this reason, the well-known location strategy should be avoided in most cases. |
If the <MetadataQueryProtocol> child element is used, the metadata request URL is constructed according to the SAML Profile for the Metadata Query Protocol, which itself is based on the Metadata Query Protocol specification. The content of the <MetadataQueryProtocol> child element will be used as the "Base URL" defined in that specification. The <MetadataQueryProtocol> child element has the following optional attribute: Name | Type | Description |
|---|
transformRef | Bean ID | A reference to a transform function for the entityID. If used, the child element must be empty. |
If the <Template> child element is used, the metadata request URL is constructed by means of a simple transform. Specifically, the value of the entityID is substituted into the template parameter "${entityID}".
The <Template> child element has the following attributes: Name | Type | Default | Description |
|---|
encodingStyle | "none", "form", "path", or "fragment" | "form" | Determines whether and how the entityID value will be URL encoded prior to replacement. Allowed values are: "none" : No encoding is performed. "form" : Encoded using URL form parameter encoding (for query parameters). "path" : Encoded using URL path encoding. "fragment" : Encoded using URL fragment encoding.
The precise definition of these terms is defined in the documentation for the methods of the Guava library's UrlEscapers class. | transformRef | Bean ID |
| A reference to a transform function for the entityID. If used, the child element must be empty. | velocityEngine | Bean ID | shibboleth.VelocityEngine | Bean ID of a custom VelocityEngine to use, generally unneeded |
If the <Regex> child element is used, the metadata request URL is constructed by means of a regular expression transform. The entityID value is first matched against the regular expression contained in the <Regex> element's match attribute. Then, the <Regex> element's content is treated as a replacement expression to run based on the results of the match. The <Regex> child element has the following required attribute: Name | Type | Req? | Description |
|---|
match | String | Y | A regular expression against which the entityID is evaluated |
Note that only numeric/positional group references (e.g., $1) are supported. |
...
There are at least three things you can do to help minimize the impact of metadata query:
Configure minCacheDuration and/or maxCacheDuration
Configure the HTTP Connection Attributes
Configure a robust chain of metadata providers
As noted above, the minCacheDuration and maxCacheDuration attributes strongly influence the life cycle of metadata in the local cache. The goal is to avoid needless interaction with the HTTP server. To achieve this goal, you need to understand the life cycle of the metadata on the server. For this reason, it is best to ask your federation operator for specific recommendations.
...
The HTTP Connection Attributes include the following attributes:
connectionRequestTimeout (default: PT5S): The maximum amount of time to wait for a connection to be returned from the HTTP client's connection pool manager.
connectionTimeout (default: PT5S): The maximum amount of time to wait to establish a connection with the remote server.
socketTimeout (default: PT5S): The maximum amount of time to wait between two consecutive packets while reading from the socket connected to the remote server.
As noted above, each of these attributes defaults to 5 seconds. You may want to tighten these timeout values further, depending on what you know about the route to the server or the server itself.
...