Metadata requireSignedMetadata=false Behavior

[Nate Klingenstein]

I also wonder why the note implies that secure interoperation is impossible without metadata signature.  I would think that TLS has been used in some environments, for instance.  Is that intended as a warning to people who are new to the technology?

> On Jun 6, 2015, at 4:14 AM, Nate Klingenstein <ndk at internet2.edu> wrote:
> 
> I’m having a hard time interpreting the default configuration in metadata-providers.xml in IdPv3.  I don't understand:
> 
> A) What happens if there's a public key but signed metadata is not required
> B) What the value is in specifying a signing key that is optional, since accepting unsigned metadata despite having a validation key seems to defeat the purpose of signing
> C) Why you wouldn't make requireSignedMetadata=true implicit behavior if there's a key, and requireSignedMetadata=false implicit behavior if there is no key, which would seem to obviate the need for requireSignedMetadata as a flag.
> 
> I'm guessing it's just an example, but I could imagine this tripping up a lot of deployers based on the inline documentation, example, and Wiki.
> 
> 
> Resources:
> 
> 
> The inline docs say:
> 
>         You *MUST*  provider the SignatureValidationFilter in order to function securely.
>         Get the PubLic key, and validate it via some out of band mechanism, from the
>         party publishing the metadata
> 
> The actual config is:
> 
>        <MetadataFilter xsi:type="SignatureValidation"
>            requireSignedMetadata="false">
>            <PublicKey>
>                THIS IS AN EXAMPLE
> 
> With documentation at:
> 
> https://wiki.shibboleth.net/confluence/display/IDP30/SignatureValidationFilter