Signed IDP 2.4 Metadata

[Peter Schober]

* Sam Wilson <swilsonau at gmail.com> [2013-11-14 13:00]:
> I am trying to find documentation to generate signed and timestamped
> (validUntil) IDP metadata. I have found the SWITCH aai documentation
> to roughly touch on this however they do not go into detail of
> signing the metadata. There are some old examples using Shibboleth
> 1.3 however I am stubbornly trying to not use deprecated things!

Let me first ask why you need to do that.
E.g. for Univie's internal/campus SSO "federation" I just pointed all
SPs to the existing national federation, where a current and signed
copy of the IdP's metadata is available. Those Shib SPs only
interested in this IdP can add a whitelist filter to only keep one IdP
around. (Of course with lesser software that might be more difficult.)

As to how, like TomS you could write a simple script that updates
metadata on disk. E.g. using Perl's XML::XPath, and rather
inefficiently iterating over all elements:

# set $filename to point to metadata input file
# set $expdate and $datetime, eg. with Date::Calc
my $xp = XML::XPath->new(filename => $filename) or die "Uaargh: $!";
$xp->setNodeText('/EntitiesDescriptor/@validUntil', $expdate);
$xp->setNodeText('/EntitiesDescriptor/@ID', "_$datetime");
my $nodeset = $xp->find('/');
open FILE, ">:utf8", $filename or die "Aaaaah: $!";
foreach my $node ($nodeset->get_nodelist) {
    print FILE XML::XPath::XMLParser::as_string($node);
}
close FILE;

Then, like Ian mentioned, sign the resulting file with samlsign from
the Shib SP distribution, or use XmlSecTool (or xmlsec1 or another
tool).
Of course you could just install pyff and let it do all that for you,
though for a single entity that borders on overkill.
-peter