Scott thanks for your answer.<br><br>> The trust plugins implemented by this code base are documented in the Shibboleth wiki.<br> [Yaowen] Can you give me the link? I can't find it in wiki.<br><br>> Have you read everything in the wiki under trust management and metadata?<br>
[Yaowen] Can you also tell me where is this located?<br><br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Fri, Jul 20, 2012 at 11:55 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 7/20/12 2:38 PM, "Yaowen Tu" <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
<br>
>When SP receive an Assertion from IdP. Usually the Assertion contains a<br>
>signature and a X509 Certificate. Then SP need to verify it, but I am<br>
>wondering which certificate SP should use to verify it?<br>
<br>
</div>That's not defined by SAML. You have to decide what trust models you want<br>
to implement for your needs. The trust plugins implemented by this code<br>
base are documented in the Shibboleth wiki.<br>
<div class="im"><br>
>1) The X509 Certificate in the metadata.xml that has been exchanged when<br>
>the SP and IdP launches.<br>
>2) The X509 Certificate in the Assertion itself.<br>
<br>
</div>You're combining verifying a signature with validating the key used to<br>
sign it. Both have to be done. Signatures carry hints about signing keys<br>
that optimize the ability to locate the key that can be used to verify<br>
them, but that has nothing to do with the validation part, which must be<br>
independent of the signature's contents.<br>
<div class="im"><br>
>I think we should use #2, is it? #1 should be used to verify the metadata<br>
>itself right? In reality, these two certificates should be the same right?<br>
<br>
</div>Yes, no, maybe. That's my standard response for "the answer is more<br>
complex than you think it is and there is no simple answer". Have you read<br>
everything in the wiki under trust management and metadata? If not, you'd<br>
better start there and you'd better deeply understand it all. So your<br>
questions would be better formed as "what does this part of the<br>
documentation mean?"<br>
<div class="im"><br>
>Can you also tell me what is the idp-metadata mainly used for? Is it used<br>
>for SP to know which URLs that SP should send to for different type of<br>
>authentication requests? Anything else?<br>
<br>
</div>Endpoint discovery, binding selection, trust management, security policy,<br>
algorithm selection, UI material for discovery interfaces, various other<br>
things.<br>
<br>
Please direct general SAML questions to the saml-dev list at OASIS. I<br>
won't answer anything else here that doesn't specifically pertain to the<br>
Shibboleth code base.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br>