InCommon metadata support

[Nick Roy <>]

On 12/7/16 4:56 PM, Cantor, Scott wrote:
> On 12/7/16, 6:47 PM, 
> "
>  on behalf of Tom Poage" 
> <
>  on behalf of 
> >
>  wrote:
>
>> I sense there’s also not much middle ground (vs. dichotomy) to make it 
>> relatively easy for Right Thing deployers to do just
>> that, and to present a semi-surmountable obstacle to Wrong Thing deployers 
>> to do, well, just that.
> I think a non-commercial trust path for the TLS layer does exactly that, as 
> best it can be done.
>
> Those verifying signatures can frankly ignore the TLS part if they like and 
> they'd still be better off than using http alone. Those not verifying 
> signatures either do nothing (which they'll do regardless) or just choose 
> to trust the cert, it's not that hard.
>
> I don't think it's a burden to install a CA. On Windows it's a double 
> click. If you claim as a vendor that it's against your security policy, 
> that's laughable when none of the CAs you already trust have any business 
> certifying SAML metadata.

You convinced me.  I think this needs to be TLS using a self-signed
cert, and if they can't add an explicit trust to their truststore, "they
are not tall enough to get on the ride"

Nick

>
> -- Scott
>
>