Developer staffing guide · 8 minute read ·
Rehearse a SAML metadata rotation before the old certificate expires — September 11 review
Check overlap, cache refresh, failed assertions, and rollback with a test identity provider.
Readiness check
Is the handoff ready?
Use this table before you send the first ticket. Fix the weak spots while access is still limited.
| Area | Ready | Needs work |
|---|---|---|
| Question | One observable SAML metadata rotation outcome | A request to inspect the whole system |
| Fixture | a test identity provider with current, next, expired, and malformed signing certificates | Customer data or shared credentials |
| Evidence | metadata version, fetch time, certificate fingerprint, assertion result, cache state, and rollback result | A pass label without observed values |
| Approval | The identity owner approves certificates, overlap timing, and production metadata changes. | The contractor changes production alone |
Reproduce the SAML metadata rotation failure safely
A service provider holds stale metadata or rejects assertions during the certificate overlap window. Start with one case that can fail without touching customer records or production infrastructure. Write the expected result, stop condition, and reviewer beside the fixture.
Use a test identity provider with current, next, expired, and malformed signing certificates. Label every identity and artifact so a reviewer can distinguish test evidence from a live record.
Leave enough evidence for a second person — September 11 review
Capture metadata version, fetch time, certificate fingerprint, assertion result, cache state, and rollback result. Include the source revision and test time. If behavior changes between runs, retain both results.
The identity owner approves certificates, overlap timing, and production metadata changes. A remote programmer can prepare the fixture, run bounded checks, and explain the result. New policy, privileged access, and release approval stay with the named owner.
Copy-ready brief
Paste this into your hiring request
Test one bounded SAML metadata rotation case against written acceptance rules.
a test identity provider with current, next, expired, and malformed signing certificates
Record metadata version, fetch time, certificate fingerprint, assertion result, cache state, and rollback result.
The identity owner approves certificates, overlap timing, and production metadata changes.
Buyer questions
Questions about planning the role
What should the first run prove?
It should show the expected SAML metadata rotation result for one controlled fixture.
What belongs in the handoff?
Include metadata version, fetch time, certificate fingerprint, assertion result, cache state, and rollback result, the source revision, and any untested condition.
Who approves a production change?
The identity owner approves certificates, overlap timing, and production metadata changes.
Sources
Planning references
These links explain the security, code review, and worker classification points used in this guide.
- NIST Secure Software Development FrameworkNIST guidance for managing software development risk.
- GitHub pull request reviewsFirst-party documentation for review and approval.