Use of metadata signature filter

[Chad La Joie]

Kinda depends what you're doing.

If it were me, I'd use xmlsectool to download the metadata and
validate the signature and then use a metadata provider without the
signature filter.  Others might use curl to download the file and then
use a metadata provider that did check the signature.

On Tue, Feb 14, 2012 at 11:04, Paul Hethmon
<paul.hethmon at clareitysecurity.com> wrote:
> Ok, so I've got a partner using MS ADFS for their SAML support. They are
> busy following the MS documents on integration including using a
> MetadataFilter for SignatureValidation. Ok, fair enough. So I'm going
> through the wiki to make sure what they are asking will work, etc.
>
> Now, here's my question. Their request is for me to load their metadata file
> from a URL. So if I do that, it does seem reasonable to validate the
> metadata file signature using the signature validation filter. However, I
> don't really want to load their metadata file dynamically, I don't want my
> system being dependent on their system. So if I do my normal file based load
> of their metadata, what purpose does signature validation serve?
>
> thanks,
>
> Paul
>
> --
>
> Paul Hethmon
> Chief Software Architect
> Clareity Security, LLC
> o) 865.824.1350
> c) 865.250.3517
> e) paul.hethmon at clareitysecurity.com
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered