Metadata Aggregator - Issues with XMLSignatureSigningStage

[Dan McLaughlin]

>> Is this something you plan to fix soon? If so, I'll wait to test it.
>
> No, it'll be at least a few more weeks before I switch back to working
> on the aggregator.

Okay, we are going to look into coding something up today.  If you
have any thoughts on how you would like it to work, naming
conventions, etc... let me know now.  I'm assuming you would want the
stage designed in such a way that the method used to generate the ID
was pluggable.   I haven't looked at the code yet, but would you
expect the Reference URI to get populated properly by the existing
XMLSignatureSigningStage code once the ID has been added to the
EntitiesDescriptor, or do you expect will have to modify the
XMLSignatureSigningStage to have an option similar to the xmlsectool
referenceIdAttributeName option?

>
>> 1) Doesn't the fact that the SP is modifying the metadata before
>> placing it in the backingfile invalidate the signature?  May it
>> doesn't matter once the SP has consumed it, but I'm still curious.
>
> Depends on what is being modified.  If it's outside the signature,
> then no it won't affect anything.

After looking over
(http://www.ibm.com/developerworks/webservices/library/ws-security.html)
it would seem due to the CanonicalizationMethod applied to the
signature that the changes made by the SP will not invalidate the
signature.

>
>> 2) Is the SP modifying the metadata only because the MDA didn't
>> generate it properly to begin with?
>
> The MDA will generate invalid XML in some cases (there are issues for
> those in the wiki), but in those cases the SP would fail to accept it
> at all.  You'd have to ask Scott exactly what the SP does, with
> metadata it accepts prior to writing it to its backup file.  Chance
> are he isn't reading this thread since he doesn't have anything to do
> with the MDA (nor is this an MDA question).

Since the serialization of the metadata by the SP/Xerces doesn't
invalidate the signature, then I'm not sure it matters.


On Tue, Jan 24, 2012 at 9:07 AM, Chad La Joie <lajoie at itumi.biz> wrote:
> On Tue, Jan 24, 2012 at 09:44, Dan McLaughlin
> <dmclaughlin at tech-consortium.com> wrote:
>> Is this something you plan to fix soon? If so, I'll wait to test it.
>
> No, it'll be at least a few more weeks before I switch back to working
> on the aggregator.
>
>> 1) Doesn't the fact that the SP is modifying the metadata before
>> placing it in the backingfile invalidate the signature?  May it
>> doesn't matter once the SP has consumed it, but I'm still curious.
>
> Depends on what is being modified.  If it's outside the signature,
> then no it won't affect anything.
>
>> 2) Is the SP modifying the metadata only because the MDA didn't
>> generate it properly to begin with?
>
> The MDA will generate invalid XML in some cases (there are issues for
> those in the wiki), but in those cases the SP would fail to accept it
> at all.  You'd have to ask Scott exactly what the SP does, with
> metadata it accepts prior to writing it to its backup file.  Chance
> are he isn't reading this thread since he doesn't have anything to do
> with the MDA (nor is this an MDA question).
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net