SP upgrade 2.3.1 to 2.4.3: disable signature validation of xml metadata?

[Cantor, Scott]

On 6/14/13 9:11 PM, "jacob at collegenet.com" <jacob at collegenet.com> wrote:
>
>We are attempting to upgrade from SP version 2.3.1 (Debian squeeze) to
>version 2.4.3 (Debian wheezy) and running into a problem where we can't
>seem to avoid signature validation of metadata loads.

I probably don't need to explain the vulnerability you're creating there.

>  Some IdPs we work with do not provide metadata with valid signatures.
>Therefore our configuration for them looks like this:
>
><MetadataProvider type="XML" uri="https://host.com/path/to/metadata.xml"
>backingFilePath="metadata-host.xml" reloadInterval="7200">
>    <TrustEngine type="StaticPKIX"
>certificate="/etc/ssl/certs/ca-certificates.crt" verifyDepth="2"/>
></MetadataProvider>

I have a suspicion as to why that may be causing it to check for a
signature, but that specific XML is nonsensical/invalid for the standard
metadata plugin. The TrustEngine serves no purpose by itself, so that's
undoubtedly causing the behavior. I don't know where you might have picked
up that idiom, but it's incorrect. If there any broken examples in the
wiki, feel free to fix them.

-- Scott