help signing metadata

[Jonathan Bricker]

I'm just trying to solve a problem my bosses have given me which is more of a PKI problem.  They care more about certs so I must care about certs.  My question was just to give me a direction to look. I now have a much better understanding of what I can and can't do with the SP.

Is there a decent doc for making plugins for the SP?

thanks

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, October 25, 2011 1:35 PM
To: users at shibboleth.net
Subject: Re: help signing metadata

On 10/25/11 1:10 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>You seem to want a simple answer. So, here goes. If you care about the
>certs, I think you're doing it wrong.

BTW, that wasn't meant glibly or as an insult, I'm saying that the design
of the system is geared towards deployers who are willing to accept the
model of metadata verification over caring about certs.

You're trying to do something else, and asking for the shortest path, and
there isn't one.

If you want to care about the certs at runtime, you have to deploy a PKI
and add very different information to the metadata (and you still have to
have a way to maintain and distribute it securely). You have to impose
critical constraints on the certificates people use, which runs into all
sorts of problems. And you do NOT put the actual certs into the metadata.
You can, but they'll be ignored at best or misinterpreted at worst.

If you want to care about the certs at metadata verification time, well,
that isn't really how it all works out of the box. So that means writing
C++ and Java code and adding plugins, or possibly moving the process of
checking all that to some other system/script/whatever. Probably the
latter would make the most sense.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net