IdP - EntityAttributes - Predicate - Regex filter for federation SPs

[Martin Lunze]

Hi Tom,

by default the validity of the metadata should be checked?

> https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration#MetadataConfiguration-AttributesAttributes
>
> requireValidMetadata
>
>
> 	Boolean 	true 	
>
> Whether candidate metadata found by the resolver must be valid in 
> order to be returned (where validity is implementation specific, but 
> in SAML cases generally depends on a |validUntil| attribute.) If this 
> flag is true, then invalid candidate metadata will not be returned.
>
So, if we understand the documentation correct, it's only a additional 
check?

> https://wiki.shibboleth.net/confluence/display/IDP30/RequiredValidUntilFilter
>
> The value of the |validUntil| attribute is too far into the future as 
> specified by the |maxValidityInterval| attribute.

Right?

With nice regards.
Martin

Am 25.04.2018 um 08:38 schrieb Martin Lunze:
> Hello Tom,
>
> thanks for your hint too.
>
> This was unintentional.
> I will talk to the guys of the DFN-AAI, maybe they will add this line 
> to their documentation.
>
> With nice regards.
> Martin
>
>
> Am 24.04.2018 um 16:37 schrieb Tom Scavo:
>> Hi Martin,
>>
>> On Tue, Apr 24, 2018 at 9:50 AM, Martin Lunze
>> <martin.lunze at tu-dresden.de> wrote:
>>> <MetadataProvider id="DFN-AAI-EduGain"
>>>      xsi:type="FileBackedHTTPMetadataProvider"
>>> backingFile="%{idp.home}/metadata/DFN-AAI-edugain-metadata.xml"
>>>
>>> metadataURL="https://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+sp-metadata.xml" 
>>>
>>>      maxRefreshDelay="PT2H">
>>>
>>>      <MetadataFilter xsi:type="SignatureValidation" 
>>> requireSignedRoot="true"
>>> certificateFile="/etc/apache2/ssl.crt/dfn-aai.g2.pem"/>
>>>      <MetadataFilter xsi:type="EntityRoleWhiteList">
>>> <RetainedRole>md:SPSSODescriptor</RetainedRole>
>>>      </MetadataFilter>
>>>      <MetadataFilter xsi:type="EntityAttributes">
>>>          <saml:Attribute
>>>              Name="https://tu-dresden.de/entity-type"
>>> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>>>
>>> <saml:AttributeValue>https://tu-dresden.de/entity-type/external/edugain</saml:AttributeValue> 
>>>
>>>          </saml:Attribute>
>>>          <ConditionRef>always-true</ConditionRef>
>>>      </MetadataFilter>
>>> </MetadataProvider>
>> I don't have an answer to your question but I wanted to ask: Did you
>> intentionally omit a RequiredValidUntil filter or was that
>> intentional?
>>
>> Cheers,
>>
>> Tom
>

-- 
Martin Lunze
IT-Systemadministrator

Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden

Tel.: +49 (351) 463-35881
E-Mail: martin.lunze at tu-dresden.de

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180425/e832546c/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5677 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20180425/e832546c/attachment.p7s>