Interfederation

[Tom Scavo <>]

On Wed, Feb 26, 2014 at 10:53 PM, Cantor, Scott 
<>
 wrote:
> On 2/26/14, 4:30 PM, "Tom Scavo" 
> <>
>  wrote:
>
>>- The use of the preview aggregate as described was not as originally
>>intended but in fact UKf already does something similar. In any case,
>>I didn't hear any violent objection to using the preview aggregate in
>>this way so let's keep this on the table for the time being.
>
> I think this is somewhat connected to the validation question, since
> obviously there's no point in staging entities if there's no manual
> vetting.

That's true but since we *do* vet InCommon metadata, the suggestion
still stands regardless of what we decide to do for "foreign"
metadata.

Btw, staging InCommon metadata in this way has significant benefits.
It essentially makes test IdPs a non-issue since presumably these
would not be released to production metadata. It also makes it easy
for participants to experiment with multiple IdPs, which is something
we don't support very well today.

>>- Everyone agreed that manual vetting of metadata was expensive and
>>didn't scale.
>>
>>The latter is certainly true, but it's also true that InCommon has
>>always had a significant manual vetting process so I'm not sure what
>>to take away from this. Are folks suggesting we treat InCommon
>>metadata differently than other metadata?
>
> I think so, yes. That's going to be a given with interfed, it means
> connecting to foreign regimes. We need a way to identify the differences,
> but I don't think it's realistic to expect that we can treat everything
> the same.

Okay, that would be...interesting. What about the following
compromise? What if we manually vet all *new* IdP metadata but let the
chips fall where they may otherwise?

Thanks,

Tom