Missing authn request signature

[Paolo Smiraglia]

Hi Peter, thanks for the reply.

See comments inline.

   Paolo

On Tue, 12 Jun 2018 at 12:04, Peter Schober <peter.schober at univie.ac.at> wrote:
>
> * Paolo Smiraglia <paolo.smiraglia at gmail.com> [2018-06-12 11:40]:
> > Recently I realised that, despite "signing=true", the AuthN requests
> > are not signed. This is the template that I use to generate the
> > shibboleth2.xml file
> >
> >    https://github.com/italia/spid-auth-docker/blob/master/etc/shibboleth/shibboleth2.xml.tpl
> >
> > Could you check if there is something wrong? Many thanks!
>
> You mean besides loading remote SAML Metadata without performing
> signature validation? ;)

In theory, the metadata come from a trusted source. Anyway, I'll put
this aspect in the TODO list... :-D

> You've changed the default location for the SAML key pair:
>
> <CredentialResolver type="File"
>   key="/opt/shibboleth-sp/certs/sp-key.pem"
>   certificate="/opt/shibboleth-sp/certs/sp-cert.pem"
>
> The software will generate a key pair from the RPM spec file but that
> will end up in /etc/shibboleth. I don't see you moving this to the
> specifified location above (e.g. in the Dockerfile) and it's not
> obvious to me that some other process puts a key pair there?
> Your README tells people to pu a key pair in
> /opt/authproxy/certs/saml/ which doesn't match the configured location
> either (unless you're doing some Docker mounting, I haven't checked).

It should be ok. The bootstrap script makes its job...

   https://github.com/italia/spid-auth-docker/blob/master/usr/local/bin/docker-bootstrap.sh#L71-L102

> But if the above were in fact the source of the error the SP should
> complain loudly during startup about a missing key pair, AFAIR.
> Did you check the logs?

I'll do it soon (not possible now).

Apart the metadata, do you see something "strange" in shibboleth.xml
template about signature?