Is it mandatory to sign the IDP metadata.

[Peter Schober]

* Vineeth K <binu.vaava at gmail.com> [2013-11-25 08:01]:
> Is it mandatory to sign the IDP metadata.
>
> In my setup SSO flow will break if signature validation for IDP metadata is
> enabled in SP. 

The documentation states that metadata filters are optional: "(zero or more)"
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider

As such the Shibboleth software does not force you to sign (or rather
validate signatures on) SAML metadata.
You just cannot sensibly enforce signature validation on metadata you
know not to be signed (which I find hardly surprising).

Of course loading (i.e., regularly importing) *unsigned* SAML metadata
over the network to establish trust in contained cryptographic keys
and protocol endpoints is fundamentally flawed (though you can at
least make the SP instrument cURL in a way to enforce TLS checking on
remote HTTPS resources).

Not sure this will be of help to you now but there's a lot of material
covering trust establishment via metadata in
https://wiki.shibboleth.net/confluence/display/SHIB2/TrustManagement
-peter