Yes, you are right. I have not commented the part concerning signature validation. However the page at TestShib does not mention anything related to uncommenting that. Also, would uncommenting that still allow me to use a self signed certificate?<br>
<br><div class="gmail_quote">On Mon, Oct 24, 2011 at 12:39 PM, Rod Widdowson <span dir="ltr"><<a href="mailto:rdw@steadingsoftware.com">rdw@steadingsoftware.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
You have probably uncommented out the bit in the RelyingParty.xml file which sets up the metadata source:<br>
<br>
> <metadata:MetadataFilter xsi:type="metadata:SignatureValidation"<br>
> trustEngineRef="shibboleth.MetadataTrustEngine"<br>
<br>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>
> requireSignedMetadata="true" /><br>
<br>
But not commented out the bit which sets up the signature validation<br>
<br>
> <!-- Trust engine used to evaluate the signature on loaded metadata. --><br>
<br>
> <security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature"><br>
<br>
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^<br>
<br>
> <security:Credential id="MyFederation1Credentials" xsi:type="security:X509Filesystem"><br>
> <security:Certificate>$IDP_HOME$/credentials/federation1.crt</security:Certificate><br>
> </security:Credential><br>
> </security:TrustEngine><br>
<div><div></div><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>