[java-metadata-aggregator] branch main updated: MDA-144: Fix XMLSignatureSigningStage namespace problems
Ian Young
ian at iay.org.uk
Mon Aug 5 14:47:56 UTC 2024
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository java-metadata-aggregator.
View the commit online:
http://git.shibboleth.net/view/?p=java-metadata-aggregator.git;a=commit;h=f76fce5e62f697d4df4b77770c100e6c08c265b2
The following commit(s) were added to refs/heads/main by this push:
new f76fce5 MDA-144: Fix XMLSignatureSigningStage namespace problems
f76fce5 is described below
commit f76fce5e62f697d4df4b77770c100e6c08c265b2
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Mon Aug 5 15:47:51 2024 +0100
MDA-144: Fix XMLSignatureSigningStage namespace problems
Use Document.normaliseDocument to ensure that all namespace
definition nodes are present before signing.
https://shibboleth.atlassian.net/browse/MDA-144
---
doc/wiki/run-all-examples.sh | 25 +++
.../metadata/dom/impl/XMLSignatureSigner.java | 10 ++
.../shibboleth/metadata/dom/saml/MDA144Test.java | 116 ++++++++++++++
.../metadata/dom/testing/BaseDOMTest.java | 21 +++
.../metadata/dom/saml/MDA144Test-input.xml | 174 +++++++++++++++++++++
.../metadata/dom/saml/MDA144Test-signingCert.pem | 18 +++
.../metadata/dom/saml/MDA144Test-signingKey.pem | 27 ++++
7 files changed, 391 insertions(+)
diff --git a/doc/wiki/run-all-examples.sh b/doc/wiki/run-all-examples.sh
index ee88515..dfb5683 100755
--- a/doc/wiki/run-all-examples.sh
+++ b/doc/wiki/run-all-examples.sh
@@ -9,13 +9,38 @@ source ./setup-softhsm.sh
echo Aggregate and Sign...
mda.sh aggregate-and-sign.xml main
+xmlsectool.sh --verifySignature \
+ --inFile path/to/output/aggregate-signed.xml \
+ --certificate path/to/secrets/self-signed.pem
+
echo Filter Aggregate...
mda.sh filter-aggregate.xml main
+
echo Aggregate and Republish...
mda.sh aggregate-and-republish.xml main
+xmlsectool.sh --verifySignature \
+ --inFile path/to/output/all-metadata.xml \
+ --certificate path/to/secrets/self-signed.pem
+xmlsectool.sh --verifySignature \
+ --inFile path/to/output/idp-metadata.xml \
+ --certificate path/to/secrets/self-signed.pem
+xmlsectool.sh --verifySignature \
+ --inFile path/to/output/sp-metadata.xml \
+ --certificate path/to/secrets/self-signed.pem
+
echo Sign Using Token...
mda.sh sign-using-token.xml main
+xmlsectool.sh --verifySignature \
+ --inFile path/to/output/signed-with-token.xml \
+ --certificate path/to/secrets/self-signed.pem
+
echo Per-entity metadata...
mda.sh per-entity.xml main
+for file in path/to/output/_*.xml; do
+ xmlsectool.sh --verifySignature \
+ --inFile $file \
+ --certificate path/to/secrets/self-signed.pem
+done
+
echo Discovery feed...
mda.sh discofeed.xml main
diff --git a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java
index b67a45b..a21b083 100644
--- a/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java
+++ b/mda-framework/src/main/java/net/shibboleth/metadata/dom/impl/XMLSignatureSigner.java
@@ -21,6 +21,8 @@ import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
+import java.time.Duration;
+import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
@@ -250,6 +252,14 @@ public class XMLSignatureSigner {
*/
public void sign(@Nonnull final Item<Element> item) throws StageProcessingException {
final Element element = item.unwrap();
+
+ // Normalise the document so that it has all the appropriate
+ // namespace nodes.
+ final var normStart = Instant.now();
+ element.getOwnerDocument().normalizeDocument();
+ final var normEnd = Instant.now();
+ log.debug("signature normalise time: {}", Duration.between(normStart, normEnd));
+
final var signature = xmlSigFactory.newXMLSignature(buildSignedInfo(element), buildKeyInfo());
final XMLSignContext context = new DOMSignContext(privKey, element, element.getFirstChild());
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/MDA144Test.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/MDA144Test.java
new file mode 100644
index 0000000..7df4b95
--- /dev/null
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/saml/MDA144Test.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.metadata.dom.saml;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.security.PrivateKey;
+import java.security.cert.X509Certificate;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.cryptacular.util.CertUtil;
+import org.cryptacular.util.KeyPairUtil;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+import org.w3c.dom.Element;
+
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.dom.DOMElementItem;
+import net.shibboleth.metadata.dom.DOMElementSerializer;
+import net.shibboleth.metadata.dom.XMLSignatureSigningStage;
+import net.shibboleth.metadata.dom.XMLSignatureValidationStage;
+import net.shibboleth.metadata.dom.testing.BaseDOMTest;
+
+public class MDA144Test extends BaseDOMTest {
+
+ protected MDA144Test() {
+ super(MDA144Test.class);
+ }
+
+ @Test
+ public void test() throws Exception {
+ // Acquire the input aggregate of two entities.
+ final var input = readDOMItem("input.xml");
+
+ // Make a collection.
+ final var items = new ArrayList<Item<Element>>();
+ items.add(input);
+
+ // Disassemble into individual entities
+ final var disassemble = new EntitiesDescriptorDisassemblerStage();
+ disassemble.setId("disassemble");
+ disassemble.initialize();
+ disassemble.execute(items);
+ disassemble.destroy();
+ Assert.assertEquals(items.size(), 2);
+
+ // Peek at the first of the new items.
+ var item1 = items.get(0);
+ Assert.assertEquals(countErrors(item1), 0);
+
+ // Glue everything back together again.
+ final var assemble = new EntitiesDescriptorAssemblerStage();
+ assemble.setId("assemble");
+ assemble.initialize();
+ assemble.execute(items);
+ assemble.destroy();
+ Assert.assertEquals(items.size(), 1);
+
+ // Signing credentials.
+ PrivateKey signingKey = KeyPairUtil.readPrivateKey(MDA144Test.class
+ .getResourceAsStream(classRelativeResource("signingKey.pem")));
+ assert signingKey != null;
+ X509Certificate signingCert = CertUtil.readCertificate(MDA144Test.class
+ .getResourceAsStream(classRelativeResource("signingCert.pem")));
+ final List<X509Certificate> certs = new ArrayList<>();
+ certs.add(signingCert);
+
+ // Sign the new aggregate.
+ final var sign = new XMLSignatureSigningStage();
+ sign.setId("sign");
+ sign.setIncludeKeyValue(false);
+ sign.setPrivateKey(signingKey);
+ sign.setCertificates(certs);
+ sign.initialize();
+ sign.execute(items);
+ sign.destroy();
+ Assert.assertEquals(countErrors(items.get(0)), 0);
+
+ // Serialise the result into something we can read in again.
+ final var bos = new ByteArrayOutputStream();
+ final var ser = new DOMElementSerializer();
+ ser.serialize(items.get(0), bos);
+ final var ba = bos.toByteArray();
+
+ // Now read it back in again.
+ final var bis = new ByteArrayInputStream(ba);
+ final var docElement = getParserPool().parse(bis).getDocumentElement();
+ assert docElement != null;
+ final var newItem = new DOMElementItem(docElement);
+
+ // Verify the signature.
+ final var signedItems = new ArrayList<Item<Element>>();
+ signedItems.add(newItem);
+ final var verify = new XMLSignatureValidationStage();
+ verify.setId("verify");
+ verify.setVerificationCertificate(signingCert);
+ verify.initialize();
+ verify.execute(signedItems);
+ verify.destroy();
+ Assert.assertEquals(countErrors(signedItems.get(0)), 0);
+ }
+
+}
diff --git a/mda-framework/src/test/java/net/shibboleth/metadata/dom/testing/BaseDOMTest.java b/mda-framework/src/test/java/net/shibboleth/metadata/dom/testing/BaseDOMTest.java
index bbed3fc..4e94d71 100644
--- a/mda-framework/src/test/java/net/shibboleth/metadata/dom/testing/BaseDOMTest.java
+++ b/mda-framework/src/test/java/net/shibboleth/metadata/dom/testing/BaseDOMTest.java
@@ -16,6 +16,7 @@ package net.shibboleth.metadata.dom.testing;
import java.io.InputStream;
import java.io.StringReader;
+import java.util.ArrayList;
import java.util.List;
import javax.annotation.Nonnull;
@@ -23,6 +24,7 @@ import javax.xml.transform.Source;
import org.testng.Assert;
import org.testng.annotations.BeforeClass;
+import org.w3c.dom.Attr;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.xmlunit.builder.DiffBuilder;
@@ -197,4 +199,23 @@ public abstract class BaseDOMTest extends BaseTest {
return errors.size();
}
+ protected static void showAttributes(final Item<Element> item, final String what) {
+ final var root = item.unwrap();
+ final var attrs = getAttributes(root);
+ System.out.println("Attributes on " + what + " (" + attrs.size() + "):");
+ for (final Attr a : attrs) {
+ System.out.println(" " + a);
+ }
+ }
+
+ protected static List<Attr> getAttributes(final Element element) {
+ final var list = new ArrayList<Attr>();
+ final var attrs = element.getAttributes();
+ for (int i = 0; i < attrs.getLength(); i++) {
+ final var attr = (Attr)attrs.item(i);
+ list.add(attr);
+ }
+ return list;
+ }
+
}
diff --git a/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-input.xml b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-input.xml
new file mode 100644
index 0000000..ce465d3
--- /dev/null
+++ b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-input.xml
@@ -0,0 +1,174 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:remd="http://refeds.or [...]
+ <Extensions>
+ <mdrpi:PublicationInfo creationInstant="2024-08-01T15:00:32Z" publisher="http://ukfederation.org.uk"/>
+ </Extensions>
+
+<EntityDescriptor ID="uk000006" entityID="https://idp2.iay.org.uk/idp/shibboleth">
+ <!--
+ This is an "Ian A. Young" IdP for Ian A. Young.
+ -->
+ <Extensions>
+
+
+
+
+ <mdrpi:RegistrationInfo registrationAuthority="http://ukfederation.org.uk" registrationInstant="2007-03-30T16:36:00Z">
+ <mdrpi:RegistrationPolicy xml:lang="en">http://ukfederation.org.uk/doc/mdrps-20130902</mdrpi:RegistrationPolicy>
+ </mdrpi:RegistrationInfo>
+ <mdattr:EntityAttributes>
+ <saml:Attribute Name="http://macedir.org/entity-category-support" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+ <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
+ </saml:Attribute>
+ </mdattr:EntityAttributes>
+ </Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <Extensions>
+ <mdui:UIInfo>
+ <mdui:DisplayName xml:lang="en">Ian A. Young</mdui:DisplayName>
+ <mdui:Description xml:lang="en">This is the identity provider for the iay.org.uk domain.</mdui:Description>
+ <mdui:Logo height="80" width="80">https://idp2.iay.org.uk/images/heads_80x80.jpg</mdui:Logo>
+ <mdui:Logo height="43" width="100">https://idp2.iay.org.uk/images/heads_100x43.jpg</mdui:Logo>
+ <mdui:Logo height="104" width="240">https://idp2.iay.org.uk/images/heads_240x104.jpg</mdui:Logo>
+ </mdui:UIInfo>
+ <mdui:DiscoHints>
+ <mdui:IPHint>217.155.173.104/29</mdui:IPHint>
+ <mdui:DomainHint>iay.org.uk</mdui:DomainHint>
+ <mdui:GeolocationHint>geo:55.9328,-3.17905</mdui:GeolocationHint>
+ </mdui:DiscoHints>
+ <shibmd:Scope regexp="false">iay.org.uk</shibmd:Scope>
+ </Extensions>
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIIDSTCCAjGgAwIBAgIhAMSPOSGN+3UUTXSKV+2EBOuF3x/pwPX/TD9GfyEkzLp+
+ MA0GCSqGSIb3DQEBBQUAMFgxGDAWBgNVBAMMD2lkcDIuaWF5Lm9yZy51azETMBEG
+ CgmSJomT8ixkARkWA2lheTETMBEGCgmSJomT8ixkARkWA29yZzESMBAGCgmSJomT
+ 8ixkARkWAnVrMB4XDTA4MDIyNTEwMzAxNFoXDTI4MDIyNTEwMzAxNFowWDEYMBYG
+ A1UEAwwPaWRwMi5pYXkub3JnLnVrMRMwEQYKCZImiZPyLGQBGRYDaWF5MRMwEQYK
+ CZImiZPyLGQBGRYDb3JnMRIwEAYKCZImiZPyLGQBGRYCdWswggEiMA0GCSqGSIb3
+ DQEBAQUAA4IBDwAwggEKAoIBAQCb6ts48g10XHTnpy+23huzR184aahkrG0AoeUl
+ FVlomPjoFDk6czq0S3Qyd+ceF7tMRu3XzS7cMmtVH53O9d+wCs8aPQcPXxHQ5gLk
+ L7Gu6eJ+3N3jXhpt7/DDPhnzFPNW3EVMueHJ/0IzyspTvq2LPbNWXJ86NKJ+gesZ
+ QftskwXScOjpoJEIP0EA890QYd4WdYtQPqVV+LPKtnYBoGOnuRhSAM1D/EhCbeb0
+ lCmRGcdGbDFBchiPO4VLGl85sLa0EhjxMIPAOKXcj8bBlO9Ww9kkG06kQp6eLHwm
+ Jmt7VNKveCGhyF2QH/CvmdUaPv3gcp1UjrlqFN9LBVSaTIL/AgMBAAEwDQYJKoZI
+ hvcNAQEFBQADggEBAG+jDBAtlKoHaEBB+l6PpW5zuiDjyHG4zZZYqX77mZ9xP/xe
+ Kn0yJ18ZLjS3b9WztGLYyC4SJHSF2okq1K02bqsCv9YeP+UWpw2uRR8jt96lLWxZ
+ jTjoko2v8jBtzDk8LZsqw58m4vZ0AGNZjKeGIywKhxnepwREguyj3bjBpZAGgl0M
+ HQuXoO/BDC9yKyZslE5CpWp5xP4XzY2/LrorrkwOJLnFuk1sox4/gvkDQukUx/jr
+ YRbrWfOjcNBx3LE/HI6RNLINicK7yUwerDE86nix5Zc3hskVcCykW+r6HbY6bx7P
+ YmNKYMZhQAgDtXIjFHOy+WbyVTidmJvxM9UeYCY=
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ </KeyDescriptor>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://idp2.iay.org.uk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp2.iay.org.uk/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">Ian A. Young</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">Ian A. Young</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://iay.org.uk/</OrganizationURL>
+ </Organization>
+ <ContactPerson contactType="support">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ukfed+fc2ee77e at iay.org.uk</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Ian</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:ukfed+fc2ee77e at iay.org.uk</EmailAddress>
+ </ContactPerson>
+
+</EntityDescriptor>
+<EntityDescriptor ID="uk000038" entityID="urn:mace:ac.uk:sdss.ac.uk:provider:identity:dur.ac.uk">
+ <!--
+ This is a Shibboleth IdP for the University of Durham.
+ -->
+ <Extensions>
+
+
+ <ukfedlabel:AccountableUsers/>
+
+ <mdrpi:RegistrationInfo registrationAuthority="http://ukfederation.org.uk" registrationInstant="2006-10-20T15:14:38Z">
+ <mdrpi:RegistrationPolicy xml:lang="en">http://ukfederation.org.uk/doc/mdrps-20130902</mdrpi:RegistrationPolicy>
+ </mdrpi:RegistrationInfo>
+ <mdattr:EntityAttributes>
+ <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+ <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
+ </saml:Attribute>
+ </mdattr:EntityAttributes>
+ </Extensions>
+ <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+ <Extensions>
+ <shibmd:Scope regexp="false">dur.ac.uk</shibmd:Scope>
+ <mdui:DiscoHints>
+ <mdui:DomainHint>dur.ac.uk</mdui:DomainHint>
+ <mdui:DomainHint>durham.ac.uk</mdui:DomainHint>
+ </mdui:DiscoHints>
+ <mdui:UIInfo>
+ <mdui:DisplayName xml:lang="en">University of Durham</mdui:DisplayName>
+ <mdui:Logo height="101" width="90">https://shib.dur.ac.uk/idp/images/du90x101.png</mdui:Logo>
+ <mdui:Logo height="16" width="16">https://shib.dur.ac.uk/idp/images/du16x16.png</mdui:Logo>
+ </mdui:UIInfo>
+ </Extensions>
+ <KeyDescriptor>
+ <ds:KeyInfo>
+ <ds:X509Data>
+ <ds:X509Certificate>
+ MIID9jCCAt6gAwIBAgIJAPxm6Cbnsa4zMA0GCSqGSIb3DQEBBQUAMHwxCzAJBgNV
+ BAYTAkdCMRYwFAYDVQQIDA1Db3VudHkgRHVyaGFtMQ8wDQYDVQQHDAZEdXJoYW0x
+ HTAbBgNVBAoMFFVuaXZlcnNpdHkgb2YgRHVyaGFtMQwwCgYDVQQLDANDSVMxFzAV
+ BgNVBAMMDnNoaWIuZHVyLmFjLnVrMB4XDTEzMDMwNDExNTYyMloXDTIzMDMwNDEx
+ NTYyMlowfDELMAkGA1UEBhMCR0IxFjAUBgNVBAgMDUNvdW50eSBEdXJoYW0xDzAN
+ BgNVBAcMBkR1cmhhbTEdMBsGA1UECgwUVW5pdmVyc2l0eSBvZiBEdXJoYW0xDDAK
+ BgNVBAsMA0NJUzEXMBUGA1UEAwwOc2hpYi5kdXIuYWMudWswggEiMA0GCSqGSIb3
+ DQEBAQUAA4IBDwAwggEKAoIBAQDb3Inw3qmbQglj/PfdG0Gt4NLlgIF3VyMMKhkX
+ KTgEZnEqMtz56yCrEQUv2q52+gEBHj5BC2I+tLH/D+hxeE2mscTsj5GYQEdXrZro
+ 8+hlAxD5ygHPYYA0vTUWXp1jy7Oa5jL9nzVFVCcxXowuEOezLFdDPR2+q99dz29O
+ Az/9b6dVHb3IatG0ueDDNE+jtr+z7s67OEsgYL9cgkOs5bTbqZe6+BHs+MuRNYTI
+ 3FmwtVRwiGEITMbAe/BRyr6Oa04uzLBqH5Xgrl/N0cqwsjo+IR9QG1GoMwY1PYa4
+ oQKr5NXMfnjZ1fZnWwbiDnRpwvxzX8nDgPdNRrjqZGQzxLofAgMBAAGjezB5MAkG
+ A1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRp
+ ZmljYXRlMB0GA1UdDgQWBBTjOCzu4jEoqNnF741QhQ6iWPfeIzAfBgNVHSMEGDAW
+ gBTjOCzu4jEoqNnF741QhQ6iWPfeIzANBgkqhkiG9w0BAQUFAAOCAQEA0Ayun4MT
+ 76SeQDaSUUJY6CSMgk65rX/U7Be3QgPLGkjnWS1jyuQ0iEMIbMINEQuqhLAhxmh1
+ yGzwt4GOwqDO/HmzGbDA02coUENR58uwPXRwGjmNIW8k+BNOvfyh018rjM7dLxJU
+ zxGW+ge+jbEjiGG/gVdarffIDjDmAONjmcdhrbunMCcL9xgH/2UDm/eowOr8TiBC
+ drL5y3PFQUwmcJwJx4hZs8GiTUtuEQa18vxYTM4tgKvOpey97hnhJxWOhk+kuH7v
+ 0pA98AVsugdhEPTTuW6EQSwKHKPWAqTE9D0hTr8frCdrSUIppziwK5Nlk5qXAn70
+ CDgIrJGVkQXCNg==
+ </ds:X509Certificate>
+ </ds:X509Data>
+ </ds:KeyInfo>
+ </KeyDescriptor>
+ <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shib.dur.ac.uk/idp/profile/SAML2/POST/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://shib.dur.ac.uk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+ <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://shib.dur.ac.uk/idp/profile/SAML2/Redirect/SSO"/>
+ </IDPSSODescriptor>
+ <Organization>
+ <OrganizationName xml:lang="en">University of Durham</OrganizationName>
+ <OrganizationDisplayName xml:lang="en">University of Durham</OrganizationDisplayName>
+ <OrganizationURL xml:lang="en">http://www.dur.ac.uk/</OrganizationURL>
+ </Organization>
+ <ContactPerson contactType="support">
+ <GivenName>Service Desk</GivenName>
+ <EmailAddress>mailto:itservicedesk at durham.ac.uk</EmailAddress>
+ </ContactPerson>
+ <ContactPerson contactType="technical">
+ <GivenName>Michael</GivenName>
+ <SurName>Young</SurName>
+ <EmailAddress>mailto:m.a.young at durham.ac.uk</EmailAddress>
+ </ContactPerson>
+
+ <ContactPerson contactType="other" remd:contactType="http://refeds.org/metadata/contactType/security">
+ <GivenName>CIS Cyber Security</GivenName>
+ <EmailAddress>mailto:cis.securityteam at durham.ac.uk</EmailAddress>
+ </ContactPerson>
+</EntityDescriptor>
+</EntitiesDescriptor>
diff --git a/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-signingCert.pem b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-signingCert.pem
new file mode 100644
index 0000000..291db1a
--- /dev/null
+++ b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-signingCert.pem
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC8DCCAdgCCQDM0iz5RbOubTANBgkqhkiG9w0BAQUFADA6MQswCQYDVQQGEwJV
+UzELMAkGA1UECBMCTUkxDTALBgNVBAoTBEFjbWUxDzANBgNVBAMTBnRlc3RlcjAe
+Fw0xMDA5MTUxNzMzMzZaFw0zMDA5MTUxNzMzMzZaMDoxCzAJBgNVBAYTAlVTMQsw
+CQYDVQQIEwJNSTENMAsGA1UEChMEQWNtZTEPMA0GA1UEAxMGdGVzdGVyMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8URyAf/z/vURAuWKo3529SGnAse7
+VRmjAuCbMMCK3GRr/UVx1Mpk1pf+16nzGhauKu7DeDKU9c0RJJlJdz+0F29ZWtL+
+lWiKTwFZwhpc4yAMlXZTTZuDfoLdIRIgwStrF7q5chXOAz3fBZL7w9ZwOK2iUmJ7
+Ut0Qn2TNE29JDvyBAcvorr4LhX5HIExvo79ftolj4ZIQxtt6Avz1ZO0cC/z/Bnwe
+LrRgTbKDHqHwx6Ei+3rY7TwdeZXAK3b2VJu9l0Hm0FPEr0QfH212/pZDytf9/h58
+VT0jJDpffjtqBnHWletNaBl/gkQBswvtvUXUCbJJ5Nv0s/kilbelBWar4QIDAQAB
+MA0GCSqGSIb3DQEBBQUAA4IBAQCyVcQo71Fy7Ng75UQrg/Nr8Ul+opFy/TP71Qcz
+IA+11PvEMUaJyFJ2nNsMCSnqcn0wPZ+S1r5B54DJzua4eoMHZ9kRIoFHe1lFX0lN
+Q2x3pb4aa23m3G4dcJGzSHJWP4oMp/jDCp8wxj3INpA4fs0dtw+iqluHP334pjM/
+5Dn55NwVlrDAtz++SxYOJXngylff14vdjNCI4m7vBbExuhTafjHxfIlkTKt7fISC
+QgRyslSMOn6acvRTrL5V9hNlY1Vccrw18xQJXbrdPBDu4l9/8J+L1hXz9EGrbWi7
+thdDlNnuJI+jlYBVNpHHT9ui5Wn3ky2gtKCT9MVNOm3GJ/5x
+-----END CERTIFICATE-----
diff --git a/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-signingKey.pem b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-signingKey.pem
new file mode 100644
index 0000000..3bd3375
--- /dev/null
+++ b/mda-framework/src/test/resources/net/shibboleth/metadata/dom/saml/MDA144Test-signingKey.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEA8URyAf/z/vURAuWKo3529SGnAse7VRmjAuCbMMCK3GRr/UVx
+1Mpk1pf+16nzGhauKu7DeDKU9c0RJJlJdz+0F29ZWtL+lWiKTwFZwhpc4yAMlXZT
+TZuDfoLdIRIgwStrF7q5chXOAz3fBZL7w9ZwOK2iUmJ7Ut0Qn2TNE29JDvyBAcvo
+rr4LhX5HIExvo79ftolj4ZIQxtt6Avz1ZO0cC/z/BnweLrRgTbKDHqHwx6Ei+3rY
+7TwdeZXAK3b2VJu9l0Hm0FPEr0QfH212/pZDytf9/h58VT0jJDpffjtqBnHWletN
+aBl/gkQBswvtvUXUCbJJ5Nv0s/kilbelBWar4QIDAQABAoIBAQDK78yJvBYrDU2a
+xyLfNJ+wvvaw0vnSsfa4k95Vmo7ypJFk/wWpe/hnvH/CPZRbDFrBiAXo03sSacQS
+qdDuuimsUJ+zUqiLWdyEadlq+CvLa4jKKzYUoEtxnXeMuqfMc83nrssPmCGp/l/a
+W3DjoDrSodJYQ7gB0iqKOAp7X27vZ3iH+HniKA0Ee8NY+mprsnOD9H0IkYgA+Cqz
+3NFryL2XmyHxpYYAG4x5223PgVpaObH07rK7TLE9mzse7n3IV9ueTSt33AaVYNz0
+eRrqTbPNXgetE/gYSbTzDWQlD5pTZOwC7YZsYojTckndmX2akNDRKvkgfOnOuPiE
+H8nwGRABAoGBAP+GxuRIEl4K+QzeXQmKAPNB0d0AYVh/koRHIRY52shoMcVp0vwP
+GtqLnkl6WSNf6AB4XLjTBDArxysyO3fAROy1QU2CHy++Y9nHQ6hLVA1RlK8pAz/K
+qdkWCQHRw2/4KlCy3R+TfuMdzI0s9gU0+Z1/PYzWlV+gBewQgu2h/NxhAoGBAPG2
+52FCZY6mOK1DNp4CUMTNI3LZj/AEmLQRUd/Oaye9Eoa9ibfk09M4/4TnDg+pts18
+sSasdd2y4GgmJW/ThbTdaREF1faL4/FWcdttcVIpLGYgTuU7q5OFFQJAAAjdkBHN
+QjabqNbQXoUniELSFFlEyH8DuXDXsf8NVERw1/+BAoGANfsuB0nmf3GH/Zz4QKyj
+2L/96tdKuVxyAnnYVo6wVogUg6UAinlSbfry3Ij5TczUAU1sISuLBfYppEl/YKQA
+q5T7D7m+huKMy5QaCfKn9gxXAc4DPrW8vfy2uGitBfmCTvwKVMJfGvHPpb9q1dzE
+Iu6ffSJT+hifR6iRUExZU+ECgYEAtCh+dsh1R4hu7/0L5WOWbcj0ZfLwzJWwd239
+V1HUHk9XUqRM1Iqys1llYdqRaW02ehw5MbkTNMXRau8bsii3HKJ2YCC4ZEXKBKRI
+wqLk9rcHh6sHAuahsJddnEq1e+YgLpSNiIQmqM2v1ZEsh5lrX0ncIodVHV03JwH5
+T/XHmIECgYEA6m9a8XRx6I1kGf3C2lOMAHzrzcT1qrN+AC09wwiS1k4fHz3NVMj7
+jtx7gleo8AHwYdf5baVTR1RZQ1FFmrkyva5l8HwCNgnWc8jocF/QfQmjB6rL8xej
+12JdMf8iDjrMrQJrLldptW7AGQ0Igr/5wn1TKawbLAVPJsFNgOS8c1A=
+-----END RSA PRIVATE KEY-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list