help signing metadata

[Jonathan Bricker]

Would it be better to check the certs at runtime when a request comes in or write a plugin to check the cert in the metadata?

thanks

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, October 25, 2011 12:48 PM
To: users at shibboleth.net
Subject: Re: help signing metadata

On 10/25/11 12:34 PM, "Jonathan Bricker" <jbricker at exacttarget.com> wrote:

>The original question was under the assumption that I could have nested
>signatures.  Using the Metadata filter was just a way for checking the
>certs.  All I want to do is have a way of checking the IDP certs are not
>expired or revoked.  Can that be done without the metadata filter?

It can't be done at all without writing plugins.

The purpose of metadata verification is not to check the certificates
controlled by the entity, it's to verify the integrity of the metadata
document itself. The only way to connect it to the certificates inside the
metadata is to self-sign the metadata with the same certificate. If you're
aggregating metadata, that means nested signatures.

But there's nothing there that imposes a relationship between the
certificate in the metadata and the signing certificate in that scenario;
that would be a different (non-existent) filter.

The trust model we advocate is to care nothing about the certificates in
the metadata, only what's used to sign it. Not every possible alternative
is supported without writing code.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net