Metadata Aggregator - Issues with XMLSignatureSigningStage

[Cantor, Scott]

> On a related note... I noticed this morning that every time the SP
> downloads the metadata I generated using the MDA, the backingfile has
> been modified by the SP to add a standalone="no" declaration to the
> XML header, it has also modified every EntityDescriptor element so its
> entityID attribute is listed after the attribute
> xmlns="urn:oasis:names:tc:SAML:2.0:metadata".

Order of attributes is not significant in XML.

> This leads me to ask two questions...
> 
> 1) Doesn't the fact that the SP is modifying the metadata before
> placing it in the backingfile invalidate the signature?  May it
> doesn't matter once the SP has consumed it, but I'm still curious.

It's not invalid.
 
> 2) Is the SP modifying the metadata only because the MDA didn't
> generate it properly to begin with?

It's not modifying it, it's serializing it. That's not under my control, Xerces is responsible for that step. The original DOM is not modified, and there are no unusual settings used. The file is not archived as a usable backup until the filtering step completes, so an invalid signature will never be backed up (that used to happen).

-- Scott