Centralized Discovery Service: problem with <ds:signature>

[Pascal Panneels]

Ian, Peter,

it is not present in our aggregated metadata for the moment till I find
a way to figure what it the problem is with the DS..

I completely agree with you over the validity of this element in the
SP's metadata. I've asked to the SP's operator to strip it of its
metadata as it is completely useless to have it, but apparently he
didn't seem to understand what was wrong using a self signed certificate
in this case.

Anyway, I will once more try to give him arguments to remove it from his
metadata.

pascal

On 20/06/13 12:57, Ian Young wrote:
> On 20 Jun 2013, at 10:24, Pascal Panneels <pascal.panneels at belnet.be> wrote:
>
>> We are now encountering some problems with new SP connecting to our federation.
> I took a quick peek at the belnet metadata but couldn't see the entity in question.  I'll assume that what has happened is that a new SP has come along with metadata for their entity that is signed, and that EntityDescriptor signature has been republished as-is.
>
>> The problematic SP have a <ds:signature> section in their metadata; while syntactically correct, their metadata is rejected by the DS with following messages in the log :
>> I know that the certificate present in their metadata is a self-signed. Is that the cause of the problem ?
> I think the deeper question is why the metadata signature on the individual entity is being republished by your federation.  As such a signature would become invalid as soon as the republished metadata changed in any way whatsoever, it is much more likely to cause problems.  I can't imagine that your federation would normally agree to republish metadata from a member with absolutely no changes, for example.  If they make ANY changes, the signature won't verify.
>
> Peter's also right in questioning what such a signature would actually mean.  A random key wrapped in a self-signed certificate signs something: if you have no reason to trust that key, what point is there in the signature?
>
> There are some circumstances (e.g., signed entity attributes) where passing along a third-party signature within metadata makes sense (and for all I know the CDS would have a problem with that too), but a signature at the EntityDescriptor level is largely an integrity check, and should be discarded (or recomputed) on republication.
>
>> Is there a tool in the Shibboleth stuff to help me verify the signature of the metadata "by hand" (I mean using command line...) ?
> XmlSecTool would be one option: 
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/XmlSecTool
>
> Or, there's a samlsign tool bundled with a part of the SP install, if you have that.
>
> However, I don't think this really helps; the issue is that the extra brittle self-signed signature should probably not be there in the first place.
>
> 	-- Ian
>
>
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
*Pascal Panneels*
Project Manager
Belnet . Services
Louizalaan 231 Avenue Louise
Brussel 1050 Bruxelles
België . Belgique
T: +32 2 790 33 33
*www.belnet.be <http://www.belnet.be>*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/1b0803f3/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3268 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20130620/1b0803f3/attachment.bin