Trust Engine shibboleth

[Rod Widdowson]

The usual reason is to provide a trust engine that you can plug into  a SignatureValidation Filter

 

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider#IdPMetadataProvider-SignatureValidationFilter

 

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of samir el otmani
Sent: 13 January 2015 15:14
To: Shib Users
Subject: Trust Engine shibboleth

 

can anyone explain me why we add this code into relaying-party.xml 

 <!-- Trust engine used to evaluate the signature on loaded metadata. -->
     <security:TrustEngine id="shibboleth.MetadataTrustEngine" xsi:type="security:StaticExplicitKeySignature">
 
      <security:Credential id="TestCredentials" xsi:type="security:X509Filesystem">
        <security:Certificate>/opt/shibboleth-idp/credentials/federation.crt</security:Certificate>
      </security:Credential>
     </security:TrustEngine>
if we can access the metadata by simple URL like this one :
https://federation.renater.fr/test/renater-test-metadata.xml
what is the utility to verify the signature on loaded metadata .
thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150113/b7a40906/attachment.html