diff --git a/roles/shibboleth/templates/shibboleth2.xml b/roles/shibboleth/templates/shibboleth2.xml
index 82ef951..a3b6047 100644
--- a/roles/shibboleth/templates/shibboleth2.xml
+++ b/roles/shibboleth/templates/shibboleth2.xml
@@ -1,155 +1,155 @@
 <SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
     xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
     xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
     xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
     xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
     clockSkew="180">
 
     <OutOfProcess logger="shibd.logger">
         <Extensions>
             <Library path="odbc-store.so" fatal="true"/>
         </Extensions>
     </OutOfProcess>
 
     <StorageService type="ODBC" id="db" cleanupInterval="900">
         <ConnectionString>
             DRIVER=MySQL;SERVER={{ hostvars['127.0.0.1']['openstackjump'].results[0]['openstack']['private_v4'] }};USER={{ mysql_shib_user }};PASSWORD={{ mysql_shib_pass }};DATABASE={{ mysql_shib_db }};APP={{ project_name }}
         </ConnectionString>
     </StorageService>
 
     <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
     <ApplicationDefaults entityID="{{ http_scheme }}{{ domain }}/shibboleth"
                          homeURL="{{ http_scheme }}{{ domain }}/Shibboleth.sso/Session"
                          REMOTE_USER="persistent-id targeted-id uniqueID"
                          signing="back"
                          requireTransportAuth="false">
 
         <!--
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
         More information on: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions
         -->
         <Sessions lifetime="28800"
                   timeout="3600"
                   relayState="ss:db"
                   checkAddress="false"
                   consistentAddress="true"
                   handlerSSL="true"
                   cookieProps="https">
 
             <!--
             In order to use a default Identity Provider add an attribute like:
             entityID="https://idp.example.org/shibboleth" to the SSO element.
             It's value should be the entityID of the default Identity Provider.
             More information on: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO
             -->
             <SSO discoveryProtocol="SAMLDS"
                  discoveryURL="https://wayf.switch.ch/SWITCHaai/WAYF">
               SAML2
             </SSO>
 
             <!-- SAML and local-only logout. -->
             <Logout>Local</Logout>
 
             <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
             <Handler type="MetadataGenerator"
                      Location="/Metadata"
                      signing="false"/>
 
             <!-- Status reporting service. The first IPv4/IPv6 address pair allows access from local host. The remaining addresses are used (or will be used in the future) by the AAI Resource Registry operated by SWITCH -->
             <Handler type="Status"
                      Location="/Status"
                      acl="127.0.0.1 ::1 130.59.138.32 2001:620::1b:20c:29ff:fe76:2467 130.59.118.224 2001:620:0:1006::255 130.59.198.12 2001:620:0:3006::256"/>
 
             <!-- Session diagnostic service. -->
             <Handler type="Session"
                      Location="/Session"/>
 
             <!-- JSON feed of discovery information. -->
             <Handler type="DiscoveryFeed"
                      Location="/DiscoFeed"/>
         </Sessions>
 
         <!--
         Allows overriding of error template information/filenames. You can
         also add attributes with values that can be plugged into the templates.
         More information on: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPErrors
         -->
         <Errors access="accessError.html"
                 supportContact="info@{{ domain }}"
                 helpLocation="https://www.switch.ch/aai/help"
                 logoLocation="https://www.switch.ch/aai/design/images/SWITCHaai.gif"
                 styleSheet="https://www.switch.ch/aai/design/shib-error.css"/>
 
         <!-- Download and verify SWITCHaai metadata -->
         <MetadataProvider type="XML"
                           validate="true"
-                          uri="http://metadata.aai.switch.ch/metadata.switchaai.xml"
-                          backingFilePath="metadata.switchaai.xml"
+                          uri="{{ shib_metadata_provider }}"
+                          backingFilePath="{{ shib_metadata_file }}"
                           reloadInterval="3600">
             <MetadataFilter type="RequireValidUntil"
                             maxValidityInterval="604800"/>
             <MetadataFilter type="Signature">
                 <TrustEngine type="StaticPKIX"
                              certificate="SWITCHaaiRootCA.crt.pem"
                              verifyDepth="2"
                              checkRevocation="fullChain"
                              policyMappingInhibit="true"
                              anyPolicyInhibit="true">
                       <TrustedName>SWITCHaai Metadata Signer</TrustedName>
                       <PolicyOID>2.16.756.1.2.6.7</PolicyOID>
                </TrustEngine>
             </MetadataFilter>
         </MetadataProvider>
 
         <!-- Map to extract attributes from SAML assertions. -->
         <AttributeExtractor type="XML"
                             validate="true"
                             reloadChanges="false"
                             path="attribute-map.xml"/>
 
 
         <!-- Use a SAML query if no attributes are supplied during SSO. -->
         <AttributeResolver type="Query"
                            subjectMatch="true"/>
 
 
         <!-- Default filtering policy for recognized attributes, lets other data pass -->
         <AttributeFilter type="XML"
                          validate="true"
                          reloadChanges="false"
                          path="attribute-policy.xml"/>
 
         <!--
         Certificate/Private key pairs are read in sequence.
         Unless specificially defined only the first
         CredentialResolver is used for attribute requests.
         More information:
         https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPCredentialResolver.
         -->
         <CredentialResolver type="Chaining">
              <CredentialResolver type="File"
                                  keyName="Active"
                                  key="/etc/shibboleth/sp-key.pem"
                                  certificate="/etc/shibboleth/sp-cert.pem"/>
         </CredentialResolver>
 
         <!--
         The default settings can be overridden by creating ApplicationOverride elements.
         More Information and examples on:
         https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride
         -->
     </ApplicationDefaults>
 
     <!-- Policies that determine how to process and authenticate runtime messages. -->
     <SecurityPolicyProvider type="XML"
                             validate="true"
                             reloadChanges="false"
                             path="security-policy.xml"/>
 
     <!-- Low-level configuration about protocols and bindings available for use. -->
     <ProtocolProvider type="XML"
                       validate="true"
                       reloadChanges="false"
                       path="protocols.xml"/>
 
 </SPConfig>
diff --git a/vars/main.yml.example b/vars/main.yml.example
index d43adcf..23cdcc6 100644
--- a/vars/main.yml.example
+++ b/vars/main.yml.example
@@ -1,99 +1,101 @@
 ---
 env: prod
 project_name: "c4science"
 ansible_ssh_user: "centos"
 http_proxy: ""
 
 user_pwd_root: ""
 user_pwd_centos: ""
 
 # OpenStack
 keypair_name: ""
 image_id: ""
 image_id_coreos: ""
 public_net: ""
 private_net: ""
 flavor_id_small:  ""
 flavor_id_medium: ""
 flavor_id_large:  ""
 
 flavor_id_small_backup: ""
 private_net_backup: ""
 image_id_backup: ""
 
 region_main: ""
 region_back: ""
 
 # Storage
 s3_access_key: ""
 s3_secret_key: ""
 s3_endpoint: ""
 s3_bucket: ""
 s3_region: ""
 
 # Lbs
 external_ip: 0.0.0.0
 backup_ip: 0.0.0.0
 ip_range: "10.0.0.0/16"
 jenkins_port: 8080
 stats_port: 8082
 monit_port: 8081
 monit_user: admin
 monit_pass: 
 
 rolling_reboot_proxy_host: "{{ external_ip }}"
 rolling_reboot_pause: 30
 rolling_reboot_wait_delay: 20
 
 # App
 developer_mode: false
 http_scheme: 'http://'
 domain: example.com
 file_domain: "{{ http_scheme }}static.{{ domain }}/"
 phabricator_path: /srv/www/facebook/
 repositories_path: /var/repo/
 phd_user: phabricator
 www_user: apache
 vcs_user: git
 vcs_port: 2222
 jenkins_admin_user: admin
 jenkins_admin_pass:
 jenkins_phab_url: "{{ http_scheme }}{{ domain }}/"
 jenkins_phab_id: "PHID-"
 jenkins_phab_secret: ""
 jenkins_url: "{{ http_scheme }}jenkins.{{ domain }}/"
+shib_metadata_file: "metadata.xml"
+shib_metadata_provider: "http://example.com/{{ shib_metadata_file }}"
 phabricator_domains:
     - "{{ domain }}"
     - 'example.com'
 
 # Dbs
 mysql_app_user: ""
 mysql_app_pass: ""
 mysql_shib_user: ""
 mysql_shib_pass: ""
 mysql_shib_db: "shibboleth"
 mysql_lbs_user: "haproxy"
 mysql_cluster_name: ""
 mysql_host: "10.0.0.0/255.255.0.0"
 
 # SSH
 ssh_keys:
     - "ssh-rsa mysuperkey1"
     - "ssh-rsa mysuperkey2"
 
 # Swap
 swap_path: "/swapfile"
 dd_bs_size_mb: 32
 swap_count: 128
 swappiness: 10
 vfs_cache_pressure: 50
 
 # Email
 configure_postfix: true
 enable_postfix_domain_rewrite: true
 enable_postfix_relayhost: true
 postfix_rewrite_domain: "{{ domain }}"
 email_alias_phabricator: ""
 email_alias_postmaster: ""
 email_alias_admin: ""
 email_monitoring: ""