Per-Entity Metadata Working Group

[Chris Phillips <>]

Thanks Scott.

I read the notes on the wiki and the google doc and couldn't find this
requirement anywhere.

If I were to fall back on something it would be the list of supported
software tools/platforms that a federation operator has.
This appears hard to come by, but I do see this:
https://spaces.internet2.edu/display/InCFederation/Software+Guidelines

And this: 
https://spaces.internet2.edu/display/InCFederation/Using+Other+Software#Usi
ngOtherSoftware-using-ad-fs

This is much like what CAF has for statements around software -- we
support the protocol not necessarily specific instances of software for
configurations.  
It allows a demarcation to be made by the fedop, but in practice
sites/implementors want to know what to do with a given piece of software.

In this case with ADFS and this working group, I think it would be prudent
to link to inCommon's supported software(protocols) and if ADFS isn't
there, then THAT's a conversation to have as opposed to 'should MDQ use
TLS transport to convey trust'.  It doesn't feel like this aspect is in
the right place. 


I definitely want to see better ADFS integration for federations in
general though.  It seems to be coming in MSFT Server2016TP3 (is that out
yet?) that can ingest an aggregate. That said, I have yet to see it in
action.  What happens in practice for any ADFS install is a ton of
powershell bulk loading things and applying settings to do anything --
even with MDQ.  If you don't do powershell,it's all by hand. (Full
disclosure - I run the adfstoolkit.org site mentioned in the I2 spaces
link BTW (with Leif ;). It hasn't been updated in a long time since not
much has transpired in a long time)

Maybe this topic appears in the risks section of the doc?

Thoughts welcome as always ..

C



On 2016-09-06, 9:05 AM, "Scott Koranda" 
<>
 wrote:

>Some InCommon Participant ADFS operators want to be able to
>consume metadata for a particular entity by pointing at a MDQ
>service that uses HTTPS as the transport and the trust
>mechanism rather than XML digital signature of the metadata.