Skip to Content.
Sympa Menu

metadata-support - Re: [Metadata-Support] significant slowdown in XML Signature validation

Subject: InCommon metadata support

List archive

Re: [Metadata-Support] significant slowdown in XML Signature validation

Chronological Thread 
  • From: "Cantor, Scott" <>
  • To: "" <>
  • Subject: Re: [Metadata-Support] significant slowdown in XML Signature validation
  • Date: Fri, 19 Feb 2016 03:52:13 +0000
  • Accept-language: en-US
  • Authentication-results: spf=pass (sender IP is;; dkim=none (message not signed) header.d=none;; dmarc=bestguesspass action=none;
  • Spamdiagnosticmetadata: NSPM
  • Spamdiagnosticoutput: 1:23

On 2/18/16, 10:19 PM,
on behalf of Jeffrey Eaton"
on behalf of

>I believe that there is value in having a metadata file which contains the
>non-global set of entities. An SP which is not published in the eduGAIN
>metadata (and is therefore unknown to non-InCommon IDPs) has no need to load
>those IDPS.

What happens when the size of that particular aggregate is also large enough
to trigger a similar expansion of processing requirements? I don't think
there's a good solution here that involves continuing down this path.

I also tend to think this is really a requirement for custom aggregates. That
particular criterion just happens to be one example. One person's obvious use
case is another's niche of little value.

>Other than being a waste of resources, there’s probably no real concern.
>That said, consider every SP out there that’s loading and parsing the full
>metadata file, containing a ton of SP metadata which is completely useless,
>and potentially thousands of IDPs which aren’t useful if they’re not part of
>the global federation. Why waste hundreds of megabytes of RAM and the CPU
>cycles when it’s not substantially harder to publish multiple metadata

It's possibly not as easy as you think, the signing process is not online or
automatic to protect the key, but ultimately not for me to say.

It is exceedingly unfortunate that the OS with a correctly functioning heap
model is Windows, I'll give you that.

-- Scott

Archive powered by MHonArc 2.6.16.

Top of Page