Awesome. Thanks for you clarification.<br><br>I am currently stuck with the SignatureTrustEngine. It seems to be a chicken egg problem. Now I am trying to verify the signature of a metadata, but I need to get the key from the metadata first. Please see the code below:<br>
<br> //Get file from file system.<br> FilesystemResource resource = new FilesystemResource( metadataFile );<br><br> ResourceBackedMetadataProvider metadataProvider = new ResourceBackedMetadataProvider( new Timer(), resource );<br>
metadataProvider.setParserPool( new BasicParserPool() );<br> metadataProvider.setRequireValidMetadata( true );<br><br> <br> MetadataCredentialResolverFactory mcrFactory = MetadataCredentialResolverFactory.getFactory();<br>
MetadataCredentialResolver credResolver = mcrFactory.getInstance( metadataProvider );<span style="background-color:rgb(204,0,0)">//Here it will fail, becuase the "metadataProvider" has not been initialized. I have to load the metadata without verifying it first to get the credential, then load it again in order to verify the signature.</span><br>
<br> SignatureTrustEngine trustEngine = new ExplicitKeySignatureTrustEngine(credResolver, <br> Configuration.getGlobalSecurityConfiguration().getDefaultKeyInfoCredentialResolver());<br><br> SignatureValidationFilter filter = new SignatureValidationFilter(trustEngine);<br>
metadataProvider.setMetadataFilter(filter);<br> metadataProvider.initialize();<br><br>Instead of using MetadataCredentialResolver, it has StaticKeyInfoCredentialResolver, but still the same problem, I need to get the credential first.<br>
<br>I understand that this question is related to what we have just discussed. Using the key inside the signature is not secure. We should either use PKI or other secure channel for example get the key directly. If I want to use PKI, could you show me some sample code if there is any? or give me some hints about what I should do? I didn't find much information in wiki.<br>
<br><br>Thanks,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Thu, Nov 1, 2012 at 2:56 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 11/1/12 5:28 PM, Yaowen Tu wrote:<br>
><br>
><br>
> For the key, I think I understand it, but I may need some<br>
> clarification. My opinion is metadata is used to provide some<br>
> information to consumer including SAML keys.<br>
<br>
</div>Yes.<br>
<div class="im"><br>
> How we can trust the metadata is to verify the signature. We need to<br>
> use some key to verify the signature. Then the question result into:<br>
> how do we trust the key used for signature. As you said, we can use<br>
> PKIX to verify the certificate and the key, or we can find some secure<br>
> channel to distribute the key. As soon as we trust the key used for<br>
> signature, we are done.<br>
<br>
</div>Yes.<br>
<div class="im"><br>
<br>
> It really doesn't matter what key we would use for SAML operations.<br>
<br>
</div>No, it doesn't matter, as long as the key is present within a<br>
KeyDescriptor under the correct role and protocol in the metadata and<br>
with the correct usage specifier.<br>
<div class="im"><br>
<br>
> We implicitly trust the SAML key because we already verified signature<br>
> and trusted metadata, so we trust everything in the metadata including<br>
> SAML key.<br>
<br>
</div>Yes. Note that signed SAML metadata containing keys is essentially<br>
another form of public key "infrastructure" (without all the actual<br>
infrastructure), in that it is cryptographically binding one or more<br>
keys to an entity's identifier and other info about the entity. Which<br>
is exactly what an X.509 certificate does.<br>
<div class="im"><br>
<br>
<br>
> So my point is that there is no technical reason why we cannot use the<br>
> same key for signature and SAML operations. My I correct?<br>
<br>
</div>As I said earlier, there is no technical reason you can't do this. You<br>
just have to decide on a trust model for the metadata signing key.<br>
<div class="HOEnZb"><div class="h5"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>