RE: [security-services] ECP and PAOS

>          Is ECP supposed to have the meta data of the SP(s)
>          and IDP(s) with which it is interacting ?

I don't think so, just the information about the IdP(s) to use and where
they're located. Metadata of a sort, but not all of it. It has to
cross-check some of what it gets to make sure things match, but the IdP is
responsible for actually verifying the consumer service endpoint, for
example.

-- Scott