Metadata requireSignedMetadata=false Behavior

[Nate Klingenstein]

I’m having a hard time interpreting the default configuration in metadata-providers.xml in IdPv3.  I don't understand:

A) What happens if there's a public key but signed metadata is not required
B) What the value is in specifying a signing key that is optional, since accepting unsigned metadata despite having a validation key seems to defeat the purpose of signing
C) Why you wouldn't make requireSignedMetadata=true implicit behavior if there's a key, and requireSignedMetadata=false implicit behavior if there is no key, which would seem to obviate the need for requireSignedMetadata as a flag.

I'm guessing it's just an example, but I could imagine this tripping up a lot of deployers based on the inline documentation, example, and Wiki.


Resources:


The inline docs say:

         You *MUST*  provider the SignatureValidationFilter in order to function securely.
         Get the PubLic key, and validate it via some out of band mechanism, from the
         party publishing the metadata

The actual config is:

        <MetadataFilter xsi:type="SignatureValidation"
            requireSignedMetadata="false">
            <PublicKey>
                THIS IS AN EXAMPLE

With documentation at:

https://wiki.shibboleth.net/confluence/display/IDP30/SignatureValidationFilter