I have an app where I may choose to configure SAML2 login in the app with:
- Public cert of IdP
- IdP SAML2 login URL
- IdP entity ID
I may also choose to, instead, provide an HTTPS metadata URL from which all of the above information is fetched. The latter implies less configuration but I'm wondering about the security aspects? I have verified that the framework validates the SSL connection for acquiring the metadata, but are there other aspects that make one of these methods preferable to the other?