Signature MetadataFilter, name, CA, CRL comparison

[Cantor, Scott]

On 12/13/11 9:19 AM, "Marc Thornton" <marc.thornton at gmail.com> wrote:
>
>If the default is the entity id, how would one override/extend the
>default?

In 2.4, you'd have to write your own plugin essentially. The svn branch
contains enhancements to the PKIX engines that allow TrustedName elements
to override this assumption. The trust model you're trying to support is
not supported by the current version.

>Also, my requirement is to verify CA certification path (single CA) and
>CRL on the signature?  Any way to combine those, in addition with the
>name verification?

There is some CRL support in 2.4, including handling https CDP extensions
and additional options as documented to control the enforcement of
revocation checking. The name verification is not (see above).

>  I haven't been able to configure it in an way that works?  I don't have
>control over the incoming metadata and the inclusion of
>Shibboleth-specific extensions, therefore I am using StaticPKIX.

I don't know whether you're talking about metadata verification or runtime
trust, but those are two different things. The static engine is usually
inappropriate for runtime trust, it's too rigid for most deployments.
There are no Shibboleth extensions relevant to metadata verification, so
you're apparently mixing models.

-- Scott