<HTML>
<HEAD>
<TITLE>OCLC Use case </TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>As I stated earlier we have a federation with about 20 thousand members and this will soon grow to more than 40,000. The entities can easily broken down into 3 categories:<BR>
<BR>
The vast majority of our entities are IDPs only. These are libraries (public and small academic) who are SAML enabling their patron populations solely (at this point) to work with OCLC services and a few other select service providers. (We are trying to break the chicken and egg cycle. By enabling a large quantity of IDPs in the space we hope that it will help incentivize other content and service providers that the investment in SAML infrastructure is worthwhile. ) <BR>
<BR>
The other extreme of our entities are those that are SPs only. We have maybe 10 entities that just publish SPSSODescriptors. <BR>
<BR>
Then we have a few (50-60) entities that have both IDP and SP descriptors. These entities are only publishing the SP for ‘internal use’. The primary use case for us is an institution’s EZProxy Server being configured to use the institution’s new IDP for authentication rather than a text file with username and passwords on that machine. <BR>
<BR>
What I was planning pre-MDX discovery was a simple extension to the SAML Metadata “Well Known URL”. It seems to me that SPs to such a large federation can reasonably be expected to ‘just deal with’ the complexities of the large metadata. Originally, in my mind, this meant that they had to download the massive Metadata file parse it and make it useable for themselves. For the OCLC SPs that meant that we retrieved and parsed out the metadata every 4 hours and exploded it into a relational database. We provide an internal metadata service RMI API that lets us query the the metadata based on entity_id and the specific information required, the information in this case is returned as Java objects. I could easily see swapping out this SP implementation to one that leverages MDX to get the targeted metadata, on demand, from the source. Transaction times and availability of course being something we would have to look at. I have no problem making these demands of ‘big SPs’, I believe that they, like us, have technical sophistication to integrate a solution that is more complex than ‘just point your implementation at an XML file’. <BR>
<BR>
I worry more about the IDPs. While many of the IDPs are hosted by us there are many that are not. I believe that the majority of those IDPs not hosted by us use IDP implementations that expect a simple URL to be configured as their metadata endpoint and are not implemented to expect or robustly support ‘massive’ metadata files. My solution to this is to provide each IDP with it’s own metadata endpoint that retrieves the metadata that it is likely to need. It is my supposition that most of the IDPs never care about any of the other IDPs and MOST of the SPs that are for ‘internal use’ don’t care about the majority of IDPs. As such I speculate that a metadata endpoint that retrieves: “All entities that have SPSSODescriptors and My Entity” is good for most IDPs. <BR>
<BR>
The metadata endpoint configuration of the ‘simple’ IDP for entity “<a href="http://example.org/idp">http://example.org/idp</a>” would be something like “<<metadata base url>>?type=simpleIDP&entity= http%3A%2F%2Fexample.org%2Fidp”.(This is meant to be logical not physical I’m sure those values should not be on the querystring but I’m trying to vet the idea, not the details... yet).<BR>
<BR>
In OCLC’s case this would result in metadata files that have maybe 100 entities rather than 40,000 and I believe that it would provide everything that the ‘simple idp’ would ever need, in a single static url. <BR>
<BR>
The big question in my mind is: how generalize-able is our situation? Is there something here that is worth incorporating into the MDX real or it is just too specific to our particular needs? <BR>
<BR>
With all that said; for our SPs the MD-query will be what we want to use. I’m just wandering about the simplification for the IDPs. <BR>
<BR>
What do you think?<BR>
<BR>
Andy<BR>
<BR>
<BR>
<BR>
</SPAN></FONT>
</BODY>
</HTML>