Per-Entity Metadata Working Group

[Scott Koranda <>]

> I do believe, however, that solving the problem by making
> every deployer operate a caching MDQ proxy is not an answer.
> If the consensus of the group is that the endpoint software
> needs to do more here, I can take that to heart, but looking
> at the problem from a broader perspective, I think that road
> leads to the conclusion that endpoints need to host the
> metadata.

I don't think asking the endpoint software to do more
necessarily leads to endpoints hosting the metdata.

I think the endpoint software needs to help bridge us during
the transition while trust is building in a federation
operated MDQ service. It doesn't have to mitigate every
conceivable type of risk, but perhaps we can identify some
middle ground between "MDQ can never fail" and "my SAML
software must predict MDQ outages ahead of time" (hopefully
you understand what I mean to communicate...).

Likewise, different organizations are going to have different
tolerances. I think the important thing is to be able to say
to them what the mitigations are and how much they cost as a
function of what they can tolerate. 

I don't think InCommon will have a one size fits all
mitigation plan for its customers.

Scott K