Per-Entity Metadata Working Group

[Tom Scavo <>]

On Thu, Oct 13, 2016 at 12:02 PM, Christopher Hubing
<>
 wrote:
>
> First off, I grabbed the InCommon metadata and dumped it into a DynamoDB
> table (with Java). I used API Gateway with CloudFront wrapped around it for
> CDN. The API Gateway talks to a Lambda function (nodejs atm) to retrieve the
> MD and return it to the client.

Cool.

> So, for example, you could hit one of the URLs below and be returned
> metadata for that entityid (or insert one of your own entityIDs). It
> currently uses a self-signed cert, so ignore any SSL warnings.

How does the CDN manage the TLS key?

> https://mdqtest.testbed.tier.internet2.edu/entities/urn:mace:incommon:uiowa.edu
> https://mdqtest.testbed.tier.internet2.edu/entities/urn:mace:incommon:psu.edu
> https://mdqtest.testbed.tier.internet2.edu/entities/urn:mace:incommon:osu.edu
> https://mdqtest.testbed.tier.internet2.edu/entities/https://uwdcc.org/shibboleth

Does your MDQ server support the SHA-1 hash version as well?

> I wanted to demonstrate that is possible to create a massively scalable app
> in a short period of time with little infrastructure to manage. The metadata
> isn't signed, but that could be done rather easily I would think.

The signing will be done (daily) on current infrastructure and the
signed entity descriptors will be pushed to the MDQ server. How does
your deployment change in that scenario?

Thanks,

Tom