Signature MetadataFilter, name, CA, CRL comparison

[Marc Thornton]

>From the MetadataFilter documentation (
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter),
under the Signature MetadataFilter, TrustEngine:

"Allows signatures to be validated using the more comprehensive trust
engine interface, which allows for a richer interpretation of signature and
key information. By default, the name of the entity over which a signature
is being verified is used as the required certificate name for trust
engines that verify credential names."

If the default is the entity id, how would one override/extend the default?

Also, my requirement is to verify CA certification path (single CA) and CRL
on the signature?  Any way to combine those, in addition with the name
verification?  I haven't been able to configure it in an way that works?  I
don't have control over the incoming metadata and the inclusion of
Shibboleth-specific extensions, therefore I am using StaticPKIX.   If the
metadata is maintained locally, I do have the option of extracting the
signature and verifying against the cert (and its name) directly... but I
also need CRL checking, hence ExplicitKey or direct
certificate="signer-cert.pem" on the MetadataFilter doesn't seem to be an
option (the TrustEngine seems to be ignored if I use the latter approach).

An example of what works is below.

      <MetadataProvider type="XML" file="sp-metadata.xml" id="sp1">
        <MetadataFilter type="Signature" verifyName="false">
          <TrustEngine type="StaticPKIX">
            <CredentialResolver type="File">
              <Certificate><Path>ca-cert.pem</Path></Certificate>
              <CRL><Path>crl.der</Path></CRL>
            </CredentialResolver>
          </TrustEngine>
        </MetadataFilter>
      </MetadataProvider>


Environment: Shibboleth SP 2.4.3, RHEL 5 x86_64, compiled from source.

Thanks in advance,
Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111213/e72bfbed/attachment.html