How Shib IdP verify the metadata from SP

[Cantor, Scott]

On 7/30/12 1:29 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
>One question we have is how IdP verifies the metadata? For example, when
>we are trying to establish a trust relationship with verious SPs what we
>need to check? and when an AuthnRequest coming, how to we know if the
>request comes from a trusted SP?

Those aren't the same question. Metadata verification is not the same as
runtime trust decision making.

Metadata verification is done with MetadataFilter plugins that perform
whatever verification is involved, signatures or whatever. Runtime trust
is handled with Trust Engine plugins. All of the plugins are documented in
the wiki, including in the links I posted.

>Can anybody also point out where is the code that handle this?

Mostly in the opensaml layer plus code in lower layers.

>I have sync-ed all the IdP source code, but it seems not very easy to
>find it out without understanding the whole thing.

None of it is in the IdP, so that's probably why you're confused.

-- Scott