[java-identity-provider COMMIT] /trunk/idp-conf/src/main/resources/conf/metadata-providers.xml

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 10 12:00:29 2016
New Revision: 8479

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=8479&view=rev
Log:
IDP-814 - improve example in metadata-providers.xml

https://issues.shibboleth.net/jira/browse/IDP-814

Modified:
    trunk/idp-conf/src/main/resources/conf/metadata-providers.xml

Modified: trunk/idp-conf/src/main/resources/conf/metadata-providers.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/metadata-providers.xml?rev=8479&r1=8478&r2=8479&view=diff
==============================================================================
--- trunk/idp-conf/src/main/resources/conf/metadata-providers.xml	(original)
+++ trunk/idp-conf/src/main/resources/conf/metadata-providers.xml	Mon Oct 10 12:00:29 2016
@@ -14,15 +14,14 @@
     <!-- ========================================================================================== -->
     <!--                             Metadata Configuration                                         -->
     <!--                                                                                            -->
-    <!--  Below you place the mechanisms which define how to load the metadata for the SP you will  -->
-    <!--  provide a service to.                                                                     -->
+    <!--  Below you place the mechanisms which define how to load the metadata for SP(s) you will   -->
+    <!--  provide service to.                                                                       -->
     <!--                                                                                            -->
     <!--  Two examples are provided.  The Shibboleth Documentation at                               -->
     <!--  https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration                -->
     <!--  provides more details.                                                                    --> 
     <!--                                                                                            -->
     <!--  NOTE.  This file SHOULD NOT contain the metadata for this IdP.                            -->
-    <!--                                                                                            -->
     <!-- ========================================================================================== -->
 
     <!--
@@ -30,8 +29,8 @@
     from a remote source.
 
     You *MUST* provide the SignatureValidationFilter in order to function securely.
-    Get the public key from the party publishing the metadata, and validate it
-    with them via some out of band mechanism.
+    Get the public key certificate from the party publishing the metadata, and validate
+    it with them via some out of band mechanism (e.g., a fingerprint on a secure page).
 
     The EntityRoleWhiteList saves memory by only loading metadata from SAML roles
     that the IdP needs to interoperate with. 
@@ -43,11 +42,7 @@
                       backingFile="%{idp.home}/metadata/localCopyFromXYZHTTP.xml"
                       metadataURL="http://WHATEVER"> 
         
-        <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true">
-            <PublicKey>
-                MIIBI.....
-            </PublicKey>
-        </MetadataFilter>
+        <MetadataFilter xsi:type="SignatureValidation" certificateFile="%{idp.home}/credentials/metaroot.pem" />
         <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/>
         <MetadataFilter xsi:type="EntityRoleWhiteList">
             <RetainedRole>md:SPSSODescriptor</RetainedRole>
@@ -60,8 +55,8 @@
     from a local file.  You might use this if you have some local SPs
     which are not "federated" but you wish to offer a service to.
     
-    If you do not provide a SignatureValidation filter, then you have the responsibility to
-    ensure that the contents are trustworthy.
+    If you do not provide a SignatureValidation filter, then you have the
+    responsibility to ensure that the contents on disk are trustworthy.
     -->
     
     <!--