Thanks a lot for your great help Brent. It looks like we may have to use PKI trust engine. Get the certificate from metadata itself is not secure. From you description, it looks like it is not a trivial task. I will carefully read the unit test code and java docs to get an idea what to do. I will get back to you later if I encounter other problems.<br>
<br>Really appreciated.<br><br><br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Thu, Nov 1, 2012 at 9:16 PM, Brent Putman <span dir="ltr"><<a href="mailto:putmanb@georgetown.edu" target="_blank">putmanb@georgetown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 11/1/12 8:31 PM, Yaowen Tu wrote:<br>
><br>
> I agree with this procedure. My question is in step 1, I need to load<br>
> a metadata using MetadataProvider without verification to get the key.<br>
<br>
</div>Just to re-iterate, conceptually that doesn't make any sense. You can't<br>
get the signing key from the metadata because that would be circular and<br>
there would be no trust. The trust material (either trusted<br>
cert/credential or PKIX info) must be obtained beforehand, out of band<br>
in some unspecified fashion.<br>
<div class="im"><br>
> In step 2, I need to load the metadata again in order to do the<br>
> verification. This is very in-efficient. I am looking for a more<br>
> elegant way to handle step 1 and step 2. A sample code would be best.<br>
><br>
> Regarding step 3, if there is any wiki page to at least tell me what I<br>
> need to implement, it would help me a lot.<br>
<br>
</div>I don't think any of this is in the wiki, unfortunately, it's all<br>
TODO'ed. But the info from the other note I just sent + the unit tests<br>
+ the JavaDocs should hopefully be enough to get you started.<br>
<br>
Thanks,<br>
Brent<br>
<div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>