Validating metadata signature based on key in metadata

[Rod Widdowson]

> Problem is if the key is in the metadata, how do I read the key in the same time as I initiate the metadatarpovider?

You need to provide the public key externally via some OOB trust mechanism.  You inject that into the signature validation filter which does all the rest of the work (like look in the metadata to see if the key is there).  You really do not want to use the key in the metadata - there would be no trust.

You should probably look at an example from the Shibboleth IdP.  It is configured in a file like this.

http://svn.shibboleth.net/view/java-shib-idp2/branches/REL_2/src/installer/resources/conf-tmpl/relying-party.xml?view=markup

Check out line 94 to 96 (which specify the filter) and lines 117-120 (which specify the key).

The code to build the filter is here (warning, you need to understand spring) 

http://svn.shibboleth.net/view/java-shib-common/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/metadata/SignatureValidationFilterBeanDefinitionParser.java?view=markup

The code to parse the public key is here 
http://svn.shibboleth.net/view/java-shib-common/branches/REL_1/src/main/java/edu/internet2/middleware/shibboleth/common/config/security/

But it is complicated enough that you'll probably get little from it.