shibd unable to verify signature when metadata is cached

[Chris Phillips]

I agree, very co-incidental.

I can put that tool question Scott C poses to rest though..it started as a
simple cut-and-paste(macbook) as we edited a record for entry into eduGAIN.

Some observations:

- This character was in the MDUI:Description field only
- It was commented on(not on this list, edugainSG's) that it *could*
appear in the certificate body after each line too (but didn't in this
case). Not sure if this would trigger the same problem in shib tools.
- eduGAIN operations has a more robust validation of signatures on
aggregates as a result.

I think relevant to the shibboleth users list is the question around
whether this character is illegal anywhere in XML given the w3.org
statements on line endings[1] and whitespace[2]?  pyFF, eduGAIN's signing
tool was identified as the tool that mutated some of the aggregate content
and was fixed[3] to behave more appropriately.

C



[1] https://www.w3.org/TR/REC-xml/#sec-line-ends
[2] https://www.w3.org/TR/2004/REC-xml11-20040204/#sec-white-space
[3] https://github.com/leifj/pyFF/issues/80




  

On 2016-03-23, 7:10 PM, "users on behalf of Cantor, Scott"
<users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>> I note that an eduGAIN entity also started publishing a description
>>containing
>> `
` within the last few days. This initially broke the eduGAIN
>>signing
>> process but once that was corrected the values eventually flowed out to
>>SP
>> which then had problems.
>
>Yes, it seemed weirdly coincidental that this happened independently
>after so many years. I wonder if some tool is involved somewhere?
>
>> I'll be adding some further filtering to our raw metadata ingest
>>routines (for
>> sources such as eduGAIN) before we re-publish them as Shibboleth SP is
>> such a critical component for us. This might be a useful consideration
>>for
>> other operators as well, should they have the capability.
>
>I don't think this got filed as a bug. It is one, if not so easy to fix.
>
>-- Scott
>
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net