IdP - EntityAttributes - Predicate - Regex filter for federation SPs

[Tom Scavo]

On Wed, Apr 25, 2018 at 3:39 AM, Martin Lunze
<martin.lunze at tu-dresden.de> wrote:
>
> by default the validity of the metadata should be checked?
>
> https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration#MetadataConfiguration-AttributesAttributes
>
> requireValidMetadata
>
> Boolean true
>
> Whether candidate metadata found by the resolver must be valid in order to
> be returned (where validity is implementation specific, but in SAML cases
> generally depends on a validUntil attribute.) If this flag is true, then
> invalid candidate metadata will not be returned.

That's not what I was asking about, but yes,
requireValidMetadata="true" by default and you should leave it that
way, in most (if not all) cases.

> So, if we understand the documentation correct, it's only a additional
> check?
>
> https://wiki.shibboleth.net/confluence/display/IDP30/RequiredValidUntilFilter
>
> The value of the validUntil attribute is too far into the future as
> specified by the maxValidityInterval attribute.
>
> Right?

Yes, you should include a RequiredValidUntil filter, right after the
SignatureValidation filter in the pipeline. AFAICT, the metadata in
question has a validity interval of 4 days so you should set
maxValidityInterval="P4D".

Since the metadata has such a short validity interval, I would be
inclined to deploy a monitor that makes sure the backup file remains
fresh. AFAIK, the Shibboleth IdP can not do this for you so I
implemented an early warning system [2] in bash.

Hope this helps,

Tom

[1] https://wiki.shibboleth.net/confluence/x/CgDKAg

> Am 25.04.2018 um 08:38 schrieb Martin Lunze:
>
> Hello Tom,
>
> thanks for your hint too.
>
> This was unintentional.
> I will talk to the guys of the DFN-AAI, maybe they will add this line to
> their documentation.
>
> With nice regards.
> Martin
>
>
> Am 24.04.2018 um 16:37 schrieb Tom Scavo:
>
> Hi Martin,
>
> On Tue, Apr 24, 2018 at 9:50 AM, Martin Lunze
> <martin.lunze at tu-dresden.de> wrote:
>
> <MetadataProvider id="DFN-AAI-EduGain"
>      xsi:type="FileBackedHTTPMetadataProvider"
>      backingFile="%{idp.home}/metadata/DFN-AAI-edugain-metadata.xml"
>
> metadataURL="https://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+sp-metadata.xml"
>      maxRefreshDelay="PT2H">
>
>      <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
>          certificateFile="/etc/apache2/ssl.crt/dfn-aai.g2.pem"/>
>      <MetadataFilter xsi:type="EntityRoleWhiteList">
>          <RetainedRole>md:SPSSODescriptor</RetainedRole>
>      </MetadataFilter>
>      <MetadataFilter xsi:type="EntityAttributes">
>          <saml:Attribute
>              Name="https://tu-dresden.de/entity-type"
>              NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>
> <saml:AttributeValue>https://tu-dresden.de/entity-type/external/edugain</saml:AttributeValue>
>          </saml:Attribute>
>          <ConditionRef>always-true</ConditionRef>
>      </MetadataFilter>
> </MetadataProvider>
>
> I don't have an answer to your question but I wanted to ask: Did you
> intentionally omit a RequiredValidUntil filter or was that
> intentional?
>
> Cheers,
>
> Tom
>
>
>
> --
> Martin Lunze
> IT-Systemadministrator
>
> Technische Universität Dresden
> Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
> Operative Prozesse und Systeme (OPS)
> 01062 Dresden
>
> Tel.: +49 (351) 463-35881
> E-Mail: martin.lunze at tu-dresden.de
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net