-
Notifications
You must be signed in to change notification settings - Fork 133
Allow definition of metadata URL for SAML plugins #280
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
I'm not sure I understand the purpose of this PR. Why not generate the metadata as described here and use nginx/apache to serve them under any path you want? Besides that, seeing the diff and reading the documentation I think that it's not clear and can be confusing what URL will be used in the end to serve the metadata. To be more specific, the documentation says:
entityid should be used as a URL that serves the metadata xml document and in your diff it says:
serve your metadata on an endpoint other than the So you set the |
Thanks for the comments @ioparaskev. We just wanted to have something simple to configure, without necessarily requiring nginx / apache in front of it. Anyway, I understand your concern on the confusing aspect of the code. I'll change the implementation so that the |
@saibot94 call it |
I renamed the endpoint and changed the description in the docs. Let me know if it makes sense, thanks! |
So, we now have to options that seem similar; they both handle the URL that will serve the metadata of the corresponding plugin. These are:
While this is good practice it is not specified by the SAML specification. The SAML specification says that the entityid is a URI. Any resource identified can be used, and in practice this has been used and deployed with For those entities there is no way to specify a URL that will serve the metadata. The metadata have to be generated separately and served by other means. This is doable and we have been working like this was for a long time. The new option At the same time |
Hi @c00kiemon5ter! I wanted to ask if there's any status update on this pull and #279 . We'd require this feature available relatively soon. :) |
We at CERN require SAML metadata URLs to be different than the ones provided by parsing the
entityId
. This comes from a need to support an old and new system concurrently, both of them having the same `This PR extends the config and allows it to be extended with a
custom_metadata_url
.