[JIRA] Commented: (JOST-170) Discard entityId instead of entire MetadataProvider

[Chad La Joie (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/JOST-170?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13586#comment-13586 ] 

Chad La Joie commented on JOST-170:
-----------------------------------

This is actually more complicated than it sounds.  The recommendation is that only the root element should be signed.  If descendant elements are signed as well and are invalid, what does that mean?  You can't remove them without invalidating the other signature(s) that cover that same content.  So, is everything covered by those "super" signatures also invalid, even if those signatures themselves validated okay?

I would recommend bringing this topic up on the dev list and we can have a discussion there about what is actually appropriate behavior.

> Discard entityId instead of entire MetadataProvider
> ---------------------------------------------------
>
>                 Key: JOST-170
>                 URL: https://issues.shibboleth.net/jira/browse/JOST-170
>             Project: OpenSAML 2 - Java
>          Issue Type: Improvement
>          Components: SAML 2
>    Affects Versions: 2.5.0
>            Reporter: pbrusten at idp.protectnetwork.org
>            Assignee: Chad La Joie
>            Priority: Minor
>
> Whenever you startup or restart an IdP and the there is a validation error for an EntityDescriptor, the entire MetadataProvider is discarded and cannot be used anymore, until the error is fixed.
> In simulated this problem in a lab environment. An EntityDescriptor of the MetadataProvider contained an invalid digital Signature. This caused the following ERROR's in our log:
> 17:52:57.426 - ERROR [org.opensaml.saml2.metadata.provider.SignatureValidationFilter:311] -  -  Signature trust establishment failed for metadata entry https://sp.example.org
> 17:52:57.427 - ERROR [org.opensaml.saml2.metadata.provider.SignatureValidationFilter:254] -  -  EntityDescriptor 'https://sp.example.org' failed signature verification, removing from metadata provider
> 17:52:57.427 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:246] -  -  Error occurred while attempting to refresh metadata from 'https://federation.org/metadata.xml', next refresh for metadata from '300000' will occur in approximately {}ms
> 17:52:57.429 - ERROR [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:414] -  -  Metadata provider failed to properly initializing, continuing on without metadata
> So instead of loading the other EntityDescriptors, part of this MetadataProvider, he discards the entire MetadataProvider because of an error in one of them. It would be better to only discard the bad entityID.
> If you reload a MetadataProvider at runtime, it falls back on a previous version in memory. This only becomes a problem when you restart your IdP.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira