ShibbolethSP : Dynamic MetadataProviders list

[Paolo de vathaire]

Thank you again for the precious information.

I chose to aggregate myself all metadata to build my own federation.
Please let me know if my following understanding is right :

Every client who wants to be part of my federation will upload their
metadata containing an EntityDescriptor
I will read and validate the uploaded file against the schema ad then
insert the EntityDescriptor inside my federation metadata file as this :

> <EntitiesDescriptor ...>
>     <EntityDescriptor >
>         ...
>     </EntityDescriptor >
>     <EntityDescriptor >
>         ...
>     </EntityDescriptor >
>
> </EntitiesDescriptor>
>

The file described above is loaded by shibboleth specifying the following
in the main conf file shibboleth2.xml :

> <MetadataProvider type="XML"
> file="pathToMyFederationMetadataFile/allMetadata.xml"/>
>

It works fine as long as I specify only one EntityDescriptor inside the
<EntitiesDescriptor>
When there are more, the file is correctly loaded at startup but the
TrustEngine cannot retrieve the certificate for other EntitiesDescriptor
but the first specified.
See the trace below :

> 2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolving
> ds:X509Certificate
> 2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved
> 1 certificate(s)
> 2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved
> 0 CRL(s)
> 2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolving
> ds:X509Certificate
> 2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved
> 1 certificate(s)
> 2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved
> 0 CRL(s)
> 2014-08-21 16:27:13 DEBUG XMLTooling.CredentialCriteria [1]: keys didn't
> match
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: unable
> to validate signature, no credentials available from peer
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: validating
> signature using certificate from within the signature
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: signature
> verified with key inside signature, attempting certificate validation...
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: checking that
> the certificate name is acceptable
> 2014-08-21 16:27:13 DEBUG XMLTooling.CredentialCriteria [1]: keys didn't
> match
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: certificate
> subject: CN=ADFS Signing - exchange2010.exchangetest.local
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match
> DN, trying TLS subjectAltName match
> 2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match
> subjectAltName, trying TLS CN match
> 2014-08-21 16:27:13 ERROR XMLTooling.TrustEngine.PKIX [1]: certificate
> name was not acceptable
> 2014-08-21 16:27:13 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [1]:
> unable to verify message signature with supplied trust engine
>

Do you have an idea on what I'm doing wrong ?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140821/38fdd9a1/attachment.html