Centralized Discovery Service: problem with <ds:signature>

[Ian Young]

On 20 Jun 2013, at 10:24, Pascal Panneels <pascal.panneels at belnet.be> wrote:

> We are now encountering some problems with new SP connecting to our federation.

I took a quick peek at the belnet metadata but couldn't see the entity in question.  I'll assume that what has happened is that a new SP has come along with metadata for their entity that is signed, and that EntityDescriptor signature has been republished as-is.

> The problematic SP have a <ds:signature> section in their metadata; while syntactically correct, their metadata is rejected by the DS with following messages in the log :

> I know that the certificate present in their metadata is a self-signed. Is that the cause of the problem ?

I think the deeper question is why the metadata signature on the individual entity is being republished by your federation.  As such a signature would become invalid as soon as the republished metadata changed in any way whatsoever, it is much more likely to cause problems.  I can't imagine that your federation would normally agree to republish metadata from a member with absolutely no changes, for example.  If they make ANY changes, the signature won't verify.

Peter's also right in questioning what such a signature would actually mean.  A random key wrapped in a self-signed certificate signs something: if you have no reason to trust that key, what point is there in the signature?

There are some circumstances (e.g., signed entity attributes) where passing along a third-party signature within metadata makes sense (and for all I know the CDS would have a problem with that too), but a signature at the EntityDescriptor level is largely an integrity check, and should be discarded (or recomputed) on republication.

> Is there a tool in the Shibboleth stuff to help me verify the signature of the metadata "by hand" (I mean using command line...) ?

XmlSecTool would be one option: 

https://wiki.shibboleth.net/confluence/display/SHIB2/XmlSecTool

Or, there's a samlsign tool bundled with a part of the SP install, if you have that.

However, I don't think this really helps; the issue is that the extra brittle self-signed signature should probably not be there in the first place.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130620/64323775/attachment.bin