Trust Engine shibboleth

[Peter Schober]

* samir el otmani <elotmani.samir at gmail.com> [2015-01-13 16:14]:
> if we can access the metadata by simple URL like this one :
> https://federation.renater.fr/test/renater-test-metadata.xml
> 
> what is the utility to verify the signature on loaded metadata

See
https://wiki.shibboleth.net/confluence/display/SHIB2/TrustManagement
for one explanation.

If you're accessing a HTTPS resource with a webbrowser interactively
you have some chance of dealing with failure modes.
A repeated and fully automated HTTP GET from a HTTP client library for
a plain text file (SAML metadata) on the other hand may not give you
the security you think you have, esp if that plain text file is used
to bootstrap trust into self-signed certificates and protocol
endpoints of contained entities.
I.e., /all/ of the trust comes from a signature on that metadata (in
the "Sign and Expire" model, as per the article above).

That's why many trust framework providers ("federations") do not even
publish their SAML metadata over https, as to not lead people into
thinking that TLS is sufficient.
-peter