A question about how to verify the Assertion sent from IdP

[Yaowen Tu]

Scott thanks for your answer.

> The trust plugins implemented by this code base are documented in the
Shibboleth wiki.
        [Yaowen] Can you give me the link? I can't find it in wiki.

> Have you read everything in the wiki under trust management and metadata?
       [Yaowen] Can you also tell me where is this located?

Yaowen


On Fri, Jul 20, 2012 at 11:55 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/20/12 2:38 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
> >When SP receive an Assertion from IdP. Usually the Assertion contains a
> >signature and a X509 Certificate. Then SP need to verify it, but I am
> >wondering which certificate SP should use to verify it?
>
> That's not defined by SAML. You have to decide what trust models you want
> to implement for your needs. The trust plugins implemented by this code
> base are documented in the Shibboleth wiki.
>
> >1) The X509 Certificate in the metadata.xml that has been exchanged when
> >the SP and IdP launches.
> >2) The X509 Certificate in the Assertion itself.
>
> You're combining verifying a signature with validating the key used to
> sign it. Both have to be done. Signatures carry hints about signing keys
> that optimize the ability to locate the key that can be used to verify
> them, but that has nothing to do with the validation part, which must be
> independent of the signature's contents.
>
> >I think we should use #2, is it? #1 should be used to verify the metadata
> >itself right? In reality, these two certificates should be the same right?
>
> Yes, no, maybe. That's my standard response for "the answer is more
> complex than you think it is and there is no simple answer". Have you read
> everything in the wiki under trust management and metadata? If not, you'd
> better start there and you'd better deeply understand it all. So your
> questions would be better formed as "what does this part of the
> documentation mean?"
>
> >Can you also tell me what is the idp-metadata mainly used for? Is it used
> >for SP to know which URLs that SP should send to for different type of
> >authentication requests? Anything else?
>
> Endpoint discovery, binding selection, trust management, security policy,
> algorithm selection, UI material for discovery interfaces, various other
> things.
>
> Please direct general SAML questions to the saml-dev list at OASIS. I
> won't answer anything else here that doesn't specifically pertain to the
> Shibboleth code base.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120724/fb8dfe18/attachment.html