Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: add notes about RAM and shibd

...

Note
iconfalse

Do not assume that anyone/anything that can authenticate at an institutional SAML IDP is necessarily a member in good standing of that institution.

That avoids any surprises with regard to account issuing practices at other institutions or IDPs.

Metadata

Load SAML Metadata that also (i..e, in addition to eduID.at member SPs) includes entities known via Interfederation agreements, such as eduGAIN:

...

For the Shibboleth SP check out the complete configuration examples provided.

Operational aspects

The interfederation-enabled SAML 2.0 Metadata document (see above) is much larger (1-2 orders of magnitude) than the one only containing entities covered by the eduID.at policies. So make sure the machine your SAML SP implementation runs on has sufficient memory (RAM) available.
xmldsig-signature validation on these large documents may also take significant CPU resources (relevant when updating metadata every few hours or every day), but adding more CPU cores to a machine will not typically speed up this process significantly as it cannot be parallelised.

The Shibboleth SP software in particular has an issue only affecting its first start, when no previously downloaded, validated and cached metadata is available locally. The Shibboleth wiki provides some ways of dealing with that (e.g. by adding a configuration snippet that disables systemd's process start timeout). Also manually starting shibd before (re-)restarting it via the service manager (systemd or otherwise) should take care of that issue.
Be sure to  follow our configuration examples, particularly with regards to the verifyBackup="false" setting on the Signature MetadataFilter.

IDP Discovery

Manually managing lists of Identity Providers users may log in from does not scale and may also not provide a proper user experience. It will therefore be necessary to deploy some kind of IDP discovery service, using additional software components which allow subjects to easily choose their preferred IDPs(s) from those available via interfederation. The eduID.at Demo SP currently demonstrates use of 3 different IDP discovery interfaces.

...