Metadata Generation Handler

1 Attributes
- 1.1 Common Attributes
- 1.2 Specific Attributes
2 Child Elements
3 Query String Parameter

Identified by type="MetadataGenerator", this handler generates sample metadata based on the SP configuration and a set of built-in assumptions. Can be supplemented through the use of a template, and supports signing.

Support for signing may leave your system vulnerable to trivial DOS attacks. If this is a concern, consider protecting the generation handler with some kind of authentication or firewall.

The purpose of this handler is NOT to supply other systems with production metadata but rather to assist with testing, and generation of metadata examples useful in understanding how to produce actual metadata. Mature deployments will often require metadata content that goes beyond what the handler can generate, and directly coupling metadata to a configuration makes certain configuration changes more likely to cause service disruptions

Attributes

Common Attributes

Specific Attributes

Name	Type	Default	Description

Name	Type	Default	Description
acl	space-delimited list of IP addresses (V4/V6) or CIDR statement	Open Access	A set of requesting addresses to limit access to.
template	local pathname		Optional XML file containing an <md:EntityDescriptor> to use as a template for the generated metadata. Any content supplied will generally be maintained and supplemented by the generation process.
cacheDuration	seconds		Optional value to use in calculating the cacheDuration attribute to embed in the generated metadata. While optional, this value SHOULD be used in any experimentation with this handler in real-time generation of metadata.
signing	boolean	false	If true, metadata will be signed using the default credential (or the named credential if keyname is used as well).
keyName	string		Optional, used as input when selecting a credential to use for metadata signing.
signingAlg	URI	coding for RSA with SHA1	The XML Signature signing algorithm to use for metadata signing.
digestAlg	URI	coding for SHA1	The XML Signature digest algorithm to use for metadata signing.
mimeType	MIME content type	application/samlmetadata+xml	Optional override of MIME type of content returned by handler.
http	boolean		Forces or disables the generation of protocol endpoints using the http scheme, regardless of which scheme is used when accessing the handler.
https	boolean		Forces or disables the generation of protocol endpoints using the http scheme, regardless of which scheme is used when accessing the handler.
validUntil	seconds		Optional value to use in calculating the validUntil attribute to embed in the generated metadata. The value is added to the current time. Note that prior to version 2.2, the cacheDuration setting was improperly being used for this purpose.
salt			Optional salt to include in a hash with the entityID to produce the ID attribute placed into the metadata. Can be used to control the ID value in concert with configuration changes to signal to metadata consumers that the metadata has or hasn't been altered.

Child Elements

Name	Cardinality	Description

Name	Cardinality	Description
<EndpointBase>	0 or more	If provided, must contain a "base" handler URL to generate endpoints against. When used, these base locations override the default behavior, which generates endpoints based only on the handler URL configured for the request to the generator, which usually means only a single virtual host can be represented in the metadata.

A variety of metadata elements can be embedded directly within the handler configuration for inclusion in the generated metadata. These include

Name	Cardinality	Description

Name	Cardinality	Description
<md:NameIDFormat>	0 or more
<md:ContactPerson>	0 or more
<md:RequestedAttribute>	0 or more
<md:AttributeConsumingService>	0 or more
<md:Organization>	0 or 1
<mdui:UIInfo>	0 or 1
<mdattr:EntityAttributes>	0 or 1

Query String Parameter

Parameters are supplied using a standard query string appended to the request. They must be URL-encoded as usual

Name	Type	Description

Name	Type	Description
entityID	URI	Identifies the requesting IdP, for the purposes of establishing settings that would influence the contents of the metadata, such as message signing flags and the credentials used. If omitted, the default settings are used.