Signing metadata

[Larissa Riedel]

Hi Scott,

I'm aware of how metadata is usually created. I've also already used the
XMLSecTool to sign metadata of an example federation.

The scenario consists of a single IdP and a single SP with both not being
in a federation. I'm trying to distribute the metadata (automatically
signed) in both directions via https.

On the SP side it's possible to sign the metadata with the signing
attribute of the MetadataGenerator.

"<Handler type="MetadataGenerator" Location="/Metadata" signing="true"/>"
Reference:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPHandler#NativeSPHandler-Attributes

So on the IDP side it's just required to have the previously exchanged
public key of the SP to verify the SP metadata.

Is there any equivalent way to automatically sign the metadata for the IdP?
I hope this explains it better.

Larissa

2017-06-21 16:53 GMT+02:00 Cantor, Scott <cantor.2 at osu.edu>:

> On 6/21/17, 10:35 AM, "users on behalf of Larissa Riedel" <
> users-bounces at shibboleth.net on behalf of larissa.riedel88 at gmail.com>
> wrote:
>
> > I know that the SP has the capability to sign his metadata, so the IdP
> only has to receive my public key to verify it.
> > Does the IdP also comes with the capability to automatically sign his
> metadata?
>
> Neither the SP nor IdP has a capability meant to be used in the way you're
> describing. Metadata is meant to be maintained separately from a software
> configuration to be of proper use, and signing the metadata is a separate
> step that depends on the trust model involved, number of IdPs and SPs, etc.
>
> > Can anybody explain the procedure to me? I am a bit confused with all
> the certificates and signatures :-).
>
> There is no "procedure", it's art, not science, and depends on the
> situation.
>
> But you should never generate metadata automatically (other than as input
> to a manual review and update), and if possible look at using a third party
> source for metadata that decouples the IdP and the SP from any direct
> interactions or exchanges of keys.
>
> If you're hosting, say, an IdP's metadata for an internal collection of
> systems and want to sign it, there's a Java tool distributed by the project
> called xmlsectool that can do it. You would need to sign it daily and
> consumers need to apply proper constraints to limit the validity window, or
> you've made revocation impossible.
>
> Start with [1]. If that doesn't make sense to you, find a federation to
> leverage to help you, or treat the whole exercise as manual and exchange
> the metadata out of band by hand, understanding the implications of that.
> Automating anything implies a degree of understanding of the security
> implications, which can be very complex.
>
> -- Scott
>
> [1] https://wiki.shibboleth.net/confluence/display/CONCEPT/TrustManagement
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/a1c7e5fe/attachment.html>