SP upgrade 2.3.1 to 2.4.3: disable signature validation of xml metadata?

[Cantor, Scott]

On 6/16/13 1:41 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>>
>><MetadataProvider type="XML" uri="https://host.com/path/to/metadata.xml"
>>backingFilePath="metadata-host.xml" reloadInterval="7200">
>>    <TrustEngine type="StaticPKIX"
>>certificate="/etc/ssl/certs/ca-certificates.crt" verifyDepth="2"/>
>></MetadataProvider>
>
>I have a suspicion as to why that may be causing it to check for a
>signature, but that specific XML is nonsensical/invalid for the standard
>metadata plugin.

Actually that's not 100% true, but that's what's tripping the check.
There's code to handle signature checking of any remote XML configuration
file, and it's activated by including that element. That's not meant for
use with metadata files (and it would never have made any sense to have it
in 2.3, so it still must have come from an incorrect example).

-- Scott