Exception when creating the signature using OpenSAML lib

[Yaowen Tu]

Brent, really appreciate your help. Now I know what went wrong. I will take
a look at the SignatureValidationFilter.

For the key, I think I understand it, but I may need some clarification. My
opinion is metadata is used to provide some information to consumer
including SAML keys. How we can trust the metadata is to verify the
signature. We need to use some key to verify the signature. Then the
question result into: how do we trust the key used for signature. As you
said, we can use PKIX to verify the certificate and the key, or we can find
some secure channel to distribute the key. As soon as we trust the key used
for signature, we are done. It really doesn't matter what key we would use
for SAML operations. We implicitly trust the SAML key because we already
verified signature and trusted metadata, so we trust everything in the
metadata including SAML key. So my point is that there is no technical
reason why we cannot use the same key for signature and SAML operations. My
I correct?

Thanks,
Yaowen


On Thu, Nov 1, 2012 at 12:51 PM, Brent Putman <putmanb at georgetown.edu>wrote:

> SignatureValidationFilter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121101/03a50875/attachment.html