Use of metadata signature filter

[Paul Hethmon]

Ok, so I've got a partner using MS ADFS for their SAML support. They are busy following the MS documents on integration including using a MetadataFilter for SignatureValidation. Ok, fair enough. So I'm going through the wiki to make sure what they are asking will work, etc.

Now, here's my question. Their request is for me to load their metadata file from a URL. So if I do that, it does seem reasonable to validate the metadata file signature using the signature validation filter. However, I don't really want to load their metadata file dynamically, I don't want my system being dependent on their system. So if I do my normal file based load of their metadata, what purpose does signature validation serve?

thanks,

Paul

--

Paul Hethmon
Chief Software Architect
Clareity Security, LLC
o) 865.824.1350
c) 865.250.3517
e) paul.hethmon at clareitysecurity.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120214/20271da7/attachment.html