Per-Entity Metadata Working Group

["Cantor, Scott" <>]

> So as a contrast, the Shibboleth IdP allows me to effectively
> say "for metadata downloaded from this URL use this X.509 CA
> trust chain to validate the TLS trust, but for metadata
> downloaded from this other URL use this other X.509 CA trust
> chain".

IIRC the SP goes even farther with this and can impose naming constraints on 
which entities you can get metadata for from a particular source (and both 
IdP and SP certainly can impose them at the layer of a metadata filter).

> You are arguing that ADFS does not (to the best of our
> knowledge so far) allow a deployer to do that and will simply
> search any and all of its trust anchors for a way to validate
> the server X.509 being used for TLS trust, correct?

I would be very surprised to learn otherwise. I would in fact be surprised to 
learn that it can rely on a trust store that doesn't just apply globally to 
every other use of TLS on the system.

-- Scott