Identity Providers (IdP) often provide a metadata file that is used when setting up SAML. This file needs to be entered into a Service Provider (SP). Do we need to keep this metadata file private and secure? Or is the information within it all safe to make public? I'm curious when setting up a service provider what level of protection we must place on this information.
The metadata file doesn't have any sensitive information in it. It provides information that the SP can use to trust an assertion coming from [IdP] (so no one else can claim to be [IdP]). The typical information it contains are: SSO URL, issuer name, and the certificate containing the PKI "public" key. All of these are pretty much public anyway (as any user can see them in the SAML assertion if they capture it in the browser). With this information, the bad guy cannot really do anything.
Source link went dead.