failed signature verification causing IdP not to load?

[Brent Putman]

On 6/12/15 12:32 PM, Cantor, Scott wrote:
> On 6/12/15, 12:17 PM, "users on behalf of Rob Gorrell" <users-bounces at shibboleth.net on behalf of rwgorrel at uncg.edu> wrote:
>
>> So is it correct that failing a signature validation on one entity will spoil things for the rest of the entity's in that same metadata provider?

It's not supposed to, no.  What's supposed to happen is that the
element with the failed signature just gets removed.



> I would be very surprised if there was more than one signature in the file. There is no validation of an entity, the signature is what's validated. The whole file is signed.

Based on this log entry and esp the line number, that's exactly what is
happening.  There is a signed EntityDescriptor child of an
EntitiesDescriptor:


11:02:00.520 - ERROR
[org.opensaml.saml2.metadata.provider.SignatureValidationFilter:254] -
EntityDescriptor
'https://odapilib.libraryreserve.com/FederatedAuthentication/saml/trust' failed
signature verification, removing from metadata provider


And based on the next line, we likely have a bug.  Something is
throwing an unchecked runtime UnsupportedOperationException. Probably
the code that attempts to remove the failed EntityDescriptor from the
parent EntitiesDescriptor:


11:02:00.540 - ERROR
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:411] -
Metadata provider failed to properly initializing, halting
org.opensaml.saml2.metadata.provider.MetadataProviderException:
java.lang.UnsupportedOperationException



I will attempt to reproduce with a unit test. If it's a bug, it likely
also affects v3.

This is also apropos of the stuff we were just discussing in another
thread with Nate.  So would be nice if it actually worked properly...  :-(



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150612/3277d8d1/attachment.html>