Exception when creating the signature using OpenSAML lib

[Yaowen Tu]

Thanks Scott, you said I need to
1) Extract the key from signature
2) Verify the signature
3) Apply a trust engine to the key

I agree with this procedure. My question is in step 1, I need to load a
metadata using MetadataProvider without verification to get the key. In
step 2, I need to load the metadata again in order to do the verification.
This is very in-efficient. I am looking for a more elegant way to handle
step 1 and step 2. A sample code would be best.

Regarding step 3, if there is any wiki page to at least tell me what I need
to implement, it would help me a lot.

Thanks,
Yaowen


On Thu, Nov 1, 2012 at 4:36 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 11/1/12 6:55 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
> >
> >I understand that this question is related to what we have just
> >discussed. Using the key inside the signature is not secure. We should
> >either use PKI or other secure channel for example get the key directly.
> >If I want to use PKI, could you show me some sample
> > code if there is any? or give me some hints about what I should do? I
> >didn't find much information in wiki.
>
> You have to let it extract the key from the signature, verify it, and then
> apply a trust engine to the key at that point to decide whether to trust
> it. Conceptually anyway.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121101/81fa87c3/attachment.html