Configuring Shibboleth SP 2.6 to send attribute queries

[Cantor, Scott]

On 8/23/17, 10:20 AM, "users on behalf of Misagh Moayyed" <users-bounces at shibboleth.net on behalf of mmoayyed at unicon.net> wrote:

> What are the "signing rules"? A few references in the spec seem to only indicate that the "the responder must identify itself to
> the requester by signing the message" but the noob in me fails to understand how.

SAML doesn't define the "how" but in Shibboleth it's via either TLS or signing, interchangeably and evaluated identically.

> Is the signing of the response to an attribute query any different than the usual signing of a response, in response to an authn-
> request? (because the initial response validates just fine)

It's the same process, but the fact that it's a query means the metadata it's looking at to get the key is the AttributeAuthorityDescriptor, and it won't fall back to looking at anything else.

> The Shib SP logs indicate that there is a key mismatch found first upon validation of the response and the validation logic then
> starts to use the certificate within the signature and begins to compare "something" (logs not exactly clear here) against the CN
> and the SubAltName of that cert. Is this bit here the key difference where metadata must be tweaked to indicate keynames of
> some sort to allow for that match? 

It can, but you really shouldn't use that, and it will be turned off by default eventually. The "something" it's comparing is the set of trusted key names from the metadata against the certificate names. The trusted names are the union of the entityID it's talking to and any key names in the metadata and there is documentation on all that in very precise terms.

-- Scott