AW: SAML metadata validation try two

[Scott Koranda]

> 
> 
> > * Brian Tingle <Brian.Tingle at ucop.edu> [2013-06-07 05:15]:
> >> How do I validate an instance of SAML metadata?  I tried XML lint, and
> >> I'm getting hella errors, but they seem like errors with the schema,
> >> not my instance:
> >
> 
> I validate metadata on a support machine which also has the
> polipo caching proxy to speed up the verification process.
> 
> xmlsectool and apparently other tools don't do any caching
> so there was a lot of traffic and timeouts to w3.org without the proxy.
> 

I use xmlsectool with a set of schema files local to the
machine. Here are the actual commands I use for validation and
then signing (run on a Debian 6 system):

$ export JAVA_HOME=/usr
$ /usr/local/bin/xmlsectool-1.2.0/xmlsectool.sh --validateSchema \
--schemaDirectory /usr/local/share/metadata-signing-schema-files \
--inFile ligo-metadata.xml
INFO  XmlSecTool - Reading XML document from file 'ligo-metadata.xml'
INFO  XmlSecTool - XML document parsed and is well-formed.
INFO  XmlSecTool - XML document is schema valid
$ /usr/local/bin/xmlsectool-1.2.0/xmlsectool.sh --sign \
--certificate /usr/local/share/cert.LIGOCA.pem \
--key /usr/local/share/key.LIGOCA.pem \
--inFile ligo-metadata.xml --outFile ligo-metadata.xml.signed \
--referenceIdAttributeName <ID> \
--keyPassword "<PASSWORD>"

where <ID> is the value for the ID attribute for the top-level
<EntitiesDescriptor> and <PASSWORD> is the password protecting
the key.

The schema files in /usr/local/share/metadata-signing-schema-files
are those downloaded from InCommon at

http://wayf.incommonfederation.org/bridge/docs/

HTH,

Scott Koranda for LIGO