InCommon metadata support

[Tom Poage <>]

On Jan 21, 2014, at 2:26 PM, Tom Scavo 
<>
 wrote:
>> Or, were contacts
>> extracted from InC metadata and mailed as respective SP site 
>> administrators?
> 
> No, we did not explicitly contact any contacts in metadata (although
> inc-ops-notifications is an open subscription list, so anyone might
> have received the original message).
> 
>> Although we switched easily, I want to know who else we might need to
>> contact.
> 
> At this point, only the site administrators have been contacted but
> your point is well taken. Perhaps we should reach out to all technical
> contacts in metadata as well? Would this help?
> 
> What do others think about contacting all technical contacts in metadata?

I think part of the answer depends on the typical number of IdPs federating 
with most SPs.

If the typical SP is someone's homegrown app and only used by one or two 
IdPs, perhaps it makes sense for IdP operators to contact them directly. 
Larger SPs--those federating with numerous IdPs--would incur some overhead of 
being contacted numerous times by each IdP operator, not to mention aggregate 
effort of N IdPs contacting M SP operators (NxM).

A though experiment: I think we've federated with roughly 40 SPs (not 
counting dev/qa sites). Although, not all are found in InCommon metadata, I 
think a decent fraction are. If we guess half, assume our IdP is remotely 
representative of a typical IdP, and there are 300+ IdPs belonging to 
InCommon, that's ballpark 6000 (300x20 overlapping) attempts to contact SP 
operators, explain the situation, suggest fixes, provide wiki URLs, test, 
communicate feedback, ....

I think about 1500 SPs are registered in the InCommon metadata. No doubt, 
many are dev/qa/staging instances, with a decent fraction redundant to 
production SPs. A quick whack at looking for 'dev' and 'qa' (*) SPs returns 
on the order of 150 entries, so let's make it 1350 SPs. It comes full circle 
to whether typical SPs are someone's one-off app hosted in the closet of a 
research lab or, say, a big library content provider.

Part of the decision I think also depends whether we wish to foster a 
spoke-and-hub model or a mesh/point-to-point model of communication for this 
initiative. :-)

Tom.

* fgrep AssertionConsumerService InCommon-metadata.xml | fgrep 'index="1"' | 
egrep 'dev|qa' | wc -l