SP upgrade 2.3.1 to 2.4.3: disable signature validation of xml metadata?

[Cantor, Scott]

On 6/17/13 4:49 PM, "Jacob Lundberg" <jacob at collegenet.com> wrote:
>
>Believe me, I wish we were in a position to dictate this kind of thing
>but the complexity of setting up a Shibboleth IdP is already way too
>much for some of our clients as it is.  I'm not sure exactly how some of
>them wind up with unsigned metadata.  I'd guess the ones with invalid
>signatures just don't know how to sign it after they've updated it...

Yes, that's the point of using federations to handle the metadata. Even if
they could sign it, you still have a key management problem.

>Ok.  I can confirm removing the TrustEngine resolves the problem.  I've
>scoured the documentation some more and I can't find an explanation of
>how to configure the list of SSL certificates which are checked for
>transport validation of XML metadata loads.  I assume some CA list is
>checked by default?  Would that be whatever the default list is for
>libcurl?  Is it configurable?

There is no such support, the transport is explicitly ignored by design in
favor of a signature. If you want to do this, I'd suggest creating a
script OOB to obtain metadata using whatever rules you prefer. Or you
could look at the Dynamic plugin, which does support transport
authentication, at least in current versions. I have no recollection of
2.4.3, it's possibly too old.

-- Scott