A question about how to verify the Assertion sent from IdP

[Cantor, Scott]

On 7/20/12 2:38 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:

>When SP receive an Assertion from IdP. Usually the Assertion contains a
>signature and a X509 Certificate. Then SP need to verify it, but I am
>wondering which certificate SP should use to verify it?

That's not defined by SAML. You have to decide what trust models you want
to implement for your needs. The trust plugins implemented by this code
base are documented in the Shibboleth wiki.

>1) The X509 Certificate in the metadata.xml that has been exchanged when
>the SP and IdP launches.
>2) The X509 Certificate in the Assertion itself.

You're combining verifying a signature with validating the key used to
sign it. Both have to be done. Signatures carry hints about signing keys
that optimize the ability to locate the key that can be used to verify
them, but that has nothing to do with the validation part, which must be
independent of the signature's contents.

>I think we should use #2, is it? #1 should be used to verify the metadata
>itself right? In reality, these two certificates should be the same right?

Yes, no, maybe. That's my standard response for "the answer is more
complex than you think it is and there is no simple answer". Have you read
everything in the wiki under trust management and metadata? If not, you'd
better start there and you'd better deeply understand it all. So your
questions would be better formed as "what does this part of the
documentation mean?"

>Can you also tell me what is the idp-metadata mainly used for? Is it used
>for SP to know which URLs that SP should send to for different type of
>authentication requests? Anything else?

Endpoint discovery, binding selection, trust management, security policy,
algorithm selection, UI material for discovery interfaces, various other
things.

Please direct general SAML questions to the saml-dev list at OASIS. I
won't answer anything else here that doesn't specifically pertain to the
Shibboleth code base.

-- Scott