Metadata requireSignedMetadata=false Behavior

[Nate Klingenstein]

I would hope the opposite, very much so. It is supported for people running it, not people who need testshib.

People use TestShib for an awful lot of things.  That said, I understand that acting as a service for new Shibboleth deployers is its primary mission, so that's why the bug is worded as it is, and it is what we're doing.  I'm just noting that I have the opposite preference, and happily agree to disagree on that.

A trust engine can do anything is the point, and you could chain trust engines together with multiple keys if you really didn't care who signed what (which itself is a problem, so that's the main reason edugain really doesn't work like that).

I was more interested in the ability to associate providers with authorities, maybe through an entity tag, the registrar tag, or even a dumb regex match on the entityID than the ability for anyone to sign anything -- see browser CA's.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150608/08d04e64/attachment.html>