Below a functional description of the UKAAF implementation, as communicated with Alax Stuart on 14-10-2021:

Ian's said in another forum "It's perhaps worth mentioning that the MDQ specification was designed for the possibility of just serving documents from disk like this; the web service approach was nice for prototyping but it's easier to scale "just serve up some files with funny names"."

1. The splitting of the EntitiesDescriptor (and all the metadata pipeline) is done by the Shibboleth MDA. https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml is the MDQ signing.

2. We tar up the individual signed files and push to our httpd-based Metadata Publication Service.

3. We unpack the tarfile & create gzipped version, SHA-formatted names and symlinks in a githook (one of Rhys' crazy / effective ideas). Shell commands here: https://github.com/ukf/ukf-meta/blob/97049ff833f6143c82bd43ca081ece5541cdd2dd/utilities/githooks/post-receive#L36

4. The httpd config hasn't been published yet. I need to get it Apache-licensed like the rest of our output & then I can send you the link. But it's not difficult: we ensure GZIP compression is supported & force everything to application/samlmetadata+xml

  • No labels