Exception when creating the signature using OpenSAML lib

[Yaowen Tu]

Thanks a lot for your great help Brent. It looks like we may have to use
PKI trust engine. Get the certificate from metadata itself is not secure.
>From you description, it looks like it is not a trivial task. I will
carefully read the unit test code and java docs to get an idea what to do.
I will get back to you later if I encounter other problems.

Really appreciated.


Yaowen


On Thu, Nov 1, 2012 at 9:16 PM, Brent Putman <putmanb at georgetown.edu> wrote:

>
> On 11/1/12 8:31 PM, Yaowen Tu wrote:
> >
> > I agree with this procedure. My question is in step 1, I need to load
> > a metadata using MetadataProvider without verification to get the key.
>
> Just to re-iterate, conceptually that doesn't make any sense.  You can't
> get the signing key from the metadata because that would be circular and
> there would be no trust.  The trust material (either trusted
> cert/credential or PKIX info) must be obtained beforehand, out of band
> in some unspecified fashion.
>
> > In step 2, I need to load the metadata again in order to do the
> > verification. This is very in-efficient. I am looking for a more
> > elegant way to handle step 1 and step 2. A sample code would be best.
> >
> > Regarding step 3, if there is any wiki page to at least tell me what I
> > need to implement, it would help me a lot.
>
> I don't think any of this is in the wiki, unfortunately, it's all
> TODO'ed.  But the info from the other note I just sent + the unit tests
> + the JavaDocs should hopefully be enough to get you started.
>
> Thanks,
> Brent
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121102/8ef1fa18/attachment.html