[JIRA] Updated: (CPPXT-78) Support configuration of name and policy restrictions for the signature metadata filter (signing certificate)

[Kaspar Brand (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/CPPXT-78?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Kaspar Brand updated CPPXT-78:
------------------------------

    Attachment: SWITCHaaiMetadataSigningCA2011.crt.pem
                SWITCHaaiMetadataSigner2011.crt.pem

Ok, here they are. 2.16.756.1.2.6.7 is the policy OID to check for. (Both anyPolicyInhibit and policyMappingInhibit can be set to "true", if desired. Support for policy mapping is not needed for this chain.)

> Support configuration of name and policy restrictions for the signature metadata filter (signing certificate)
> -------------------------------------------------------------------------------------------------------------
>
>                 Key: CPPXT-78
>                 URL: https://issues.shibboleth.net/jira/browse/CPPXT-78
>             Project: XMLTooling - C++
>          Issue Type: Improvement
>          Components: Security
>            Reporter: Kaspar Brand
>            Assignee: Scott Cantor
>            Priority: Minor
>             Fix For: 1.5
>
>         Attachments: CPPXT-78-testdata.zip, SSPCPP-369-v1.diff, SWITCHaaiMetadataSigner2011.crt.pem, SWITCHaaiMetadataSigningCA2011.crt.pem
>
>   Original Estimate: 2 days
>          Time Spent: 3 hours
>  Remaining Estimate: 0 minutes
>
> Reported by Kaspar Brand, moved from old Jira:
> The Signature MetadataFilter currently doesn't allow to configure specific restrictions on the signing certificate when using the PKIX trust engine (https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter#NativeSPMetadataFilter-SignatureMetadataFilter).
> The only way to correlate the signing cert to particular metadata is through the "the name of the entity over which a signature is being verified" - this doesn't offer much flexibility, however (it possibly requires you to have a signing cert for each entity you sign).
> The IdP supports the notion of a "trusted name" (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPPKIXTrustedName) when configuring the trust engine for a signature validation filter (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-SignatureValidationFilter).
> It would be useful to have support for TrustedName child elements in the trust engine config for the SP, to (where the value of that element would be checked using AbstractPKIXTrustEngine::checkEntityNames).
> Additionally, support for configuring policy restrictions (through one or more PolicyOID child elements, e.g.) would be a real plus. I.e., a trust engine configuration would then look like this:
>                 <TrustEngine type="StaticPKIX" certificate="/etc/shibboleth/FooCA.crt.pem"
>                              verifyDepth="2" checkRevocation="fullChain">
>                     <TrustedName>Foo Federation Metadata Signer</TrustedName>
>                     <PolicyOID>2.16.756.1.2.6.7.1.1</PolicyOID>
>                 </TrustEngine>
> (In OpenSSL, X509_VERIFY_PARAM_set1_policies() is used to configure policy checking. It was introduced with version 0.9.8. The X509_V_FLAG_EXPLICIT_POLICY, X509_V_FLAG_INHIBIT_ANY and X509_V_FLAG_INHIBIT_MAP verification flags should also be set accordingly [perhaps user-controllable?])
> Is this something which can perhaps be done in 2.5? I'd be willing to help with testing, of course.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira