help signing metadata

[Jonathan Bricker]

The original question was under the assumption that I could have nested signatures.  Using the Metadata filter was just a way for checking the certs.  All I want to do is have a way of checking the IDP certs are not expired or revoked.  Can that be done without the metadata filter? 

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, October 25, 2011 11:13 AM
To: users at shibboleth.net
Subject: Re: help signing metadata

On 10/25/11 10:52 AM, "Jonathan Bricker" <jbricker at exacttarget.com> wrote:

>I want to check that the certificates are good ( i.e. not expired or
>revoked) and from a list of acceptable CA certs.  I'm trying to find out
>how to do that.  Checking signatures seems way to do it rather than
>checking certs at runtime.

That still says nothing about nested signatures or anything like that,
which was the basis of your original error. Without nested signatures
there should be *one* CA cert since there's one signature involved.

It would be very unusual, and most likely an error, to allow for a bunch
of CAs in the verification of a given metadata signer, because there is
right now no signer name involved. You would be essentially saying "any
certificate issued by these CAs can sign the metadata". That would be, to
use a technical term, very bad in the case of most CAs.

I think what you really mean is that you want to collect up metadata
signed by a bunch of different certificates and somehow verify all of it
at once. There's no way I can think of to do that because of the super
signature needed. You can impose a filter that verifies the super
signature OR you can impose a filter that identifies all the CAs and
requires that the signing certificates all contain the entityID being
signed to maintain the necessary security, but you can't do both at the
moment.

We just don't cater to models where entities are signing their own
metadata, because it's circular. And we assume that if you're going to do
that, you'd rather pull the metadata directly from the endpoints so that
it's fresh. In that scenario, you would use the Dynamic provider. In that
case, you don't have the super signature problem since the metadata isn't
aggregated.

I'm basically still just guessing at your intent here.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net