AW: SAML metadata validation try two

[Douglas E. Engert]

On 6/10/2013 10:07 AM, Scott Koranda wrote:
>>
>>
>>> * Brian Tingle <Brian.Tingle at ucop.edu> [2013-06-07 05:15]:
>>>> How do I validate an instance of SAML metadata?  I tried XML lint, and
>>>> I'm getting hella errors, but they seem like errors with the schema,
>>>> not my instance:
>>>
>>
>> I validate metadata on a support machine which also has the
>> polipo caching proxy to speed up the verification process.
>>
>> xmlsectool and apparently other tools don't do any caching
>> so there was a lot of traffic and timeouts to w3.org without the proxy.
>>

Using wireshark, I found that the xmlsectool-1.1.5 was hitting
w3.org even though I thought I had all the schema files local.
Thus the addition of the proxy on the server, and adding these
two parameters to the xmlsectool:
    --httpProxy 127.0.0.1 \
    --httpProxyPort 8123 \

Does the xmlsectool-1.2.0 support a cache?

>
> I use xmlsectool with a set of schema files local to the
> machine. Here are the actual commands I use for validation and
> then signing (run on a Debian 6 system):
>
> $ export JAVA_HOME=/usr
> $ /usr/local/bin/xmlsectool-1.2.0/xmlsectool.sh --validateSchema \
> --schemaDirectory /usr/local/share/metadata-signing-schema-files \
> --inFile ligo-metadata.xml
> INFO  XmlSecTool - Reading XML document from file 'ligo-metadata.xml'
> INFO  XmlSecTool - XML document parsed and is well-formed.
> INFO  XmlSecTool - XML document is schema valid
> $ /usr/local/bin/xmlsectool-1.2.0/xmlsectool.sh --sign \
> --certificate /usr/local/share/cert.LIGOCA.pem \
> --key /usr/local/share/key.LIGOCA.pem \
> --inFile ligo-metadata.xml --outFile ligo-metadata.xml.signed \
> --referenceIdAttributeName <ID> \
> --keyPassword "<PASSWORD>"
>
> where <ID> is the value for the ID attribute for the top-level
> <EntitiesDescriptor> and <PASSWORD> is the password protecting
> the key.
>
> The schema files in /usr/local/share/metadata-signing-schema-files
> are those downloaded from InCommon at
>
> http://wayf.incommonfederation.org/bridge/docs/
>
> HTH,
>
> Scott Koranda for LIGO
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444