Search code examples
saml-2.0spring-saml

Why to configure SP generated metadata in SP and IDP?

I'm using the spring saml example application spring-security-saml2-sample. Here I discovered two parts with generated metadata:

  1. I've generated sp metadata via the admin interface and uploaded the metadata to the IDP (ssocircle).
  2. Further a MetadataGenerator must be configured or preconfigured metadata must be defined in the spring application (SP).

So why do I need SP generated metadata twice? If MetadataGenerator is configured, I've even a static version (uploaded to IDP) and a dynamic local version.

Solution

  • You don't. You can either auto-generate metadata, or pre-configure them. Both variants work. It's recommended to use pre-configured ones for production in order to remove any potentially environment-dependent auto-generation during application startup.