Centralized Discovery Service: problem with <ds:signature>

[Ian Young]

On 20 Jun 2013, at 12:39, Pascal Panneels <pascal.panneels at belnet.be> wrote:

> it is not present in our aggregated metadata for the moment till I find a way to figure what it the problem is with the DS..

If we're talking about a signature over the EntityDescriptor, you should not include it in your aggregated metadata at all.  This is something that you, as a registrar or federation operator, need to remove in order to ensure that the metadata aggregate you publish is functional.

For example, if you leave this signature in and then add an mdrpi:RegistrationInfo element to comply with the eduGAIN metadata profile, then that *will* cause the signature to fail to verify.

> I completely agree with you over the validity of this element in the SP's metadata. I've asked to the SP's operator to strip it of its metadata as it is completely useless to have it, but apparently he didn't seem to understand what was wrong using a self signed certificate in this case.
> 
> Anyway, I will once more try to give him arguments to remove it from his metadata.


In my opinion, it's not only useless but positively harmful, as it prevents you as registrar from making any changes to the metadata.  That makes it your responsibility, not his, to decide whether it should be present or not.

For the record, in the UK federation we strip all signatures on EntityDescriptors submitted to us.

	-- Ian

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130621/bd00df57/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4877 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130621/bd00df57/attachment-0001.bin