Shibboleth2 IdP TrustEngine Extension using DANE, is it the right way?

[Christoffer Holmstedt]

Hi
My name is Christoffer and I'm currently doing my Bachelor Thesis
together with a fellow student. The topic of the thesis is "Use of
DANE to improve the security for identity federations" and to be more
specific we have put focus on the use of certificates within SAML2
federations. DANE, DNS-Based Authentication of Named Entities, is
currently only specified in ietf drafts and an informational standard
concerning use cases. Therefore what we're trying to achieve is just
one basic proof-of-concept that it's possible to implement DANE for
certificates.

The reason I'm mailing the devs list now is that we're looking for
some help concerning this proof-of-concept, we aim to create an IdP
extension. What we have come up with so far is the following. (Basic
assumption is that it's a federation with a aggregated metadata file
that is signed).

We believe that it's a TrustEngine Extension that we should implement.
First retrieve the metadata as normal. With the domain specified in
the name attribute from "md:EntitiesDescriptor", we will make a DNS
request for CERT RR that are available. We will then match the
retrieved CERT RR with the certificate available in the signed
metadata file. If it's a match we continue otherwise the metadata
validation will fail.

Now to our questions:
1) Are we on the right track with implementing a TrustEngine extension
for this or are there better alternatives, something that we might
have missed?

2) We have found the already implemented ChaningTrustEngine and the
others in org.opensaml.xml.security.trust but we're not sure which
type is the proper one to extend (signatures, credentials or "other")
as stated on the wiki [1]. Anyone able to shed some light on this one?

3) As a follow up on the second question any hint or pointers to
similiar TrustEngines already implemented would much appreciated.

[1] https://wiki.shibboleth.net/confluence/display/SHIB2/IdPExtTrustEngine

If you have any questions don't hesitate to ask. All help is appreciated.
--
Best Regards
Christoffer Holmstedt