Matadata aggregator , federation named groupID for filters

[Jehan PROCACCIA]

Thanks Ian, 
setting p:descriptorName="myname" in EntitiesDescriptorAssemblerStage bean does the job : 
<bean id="createEntitiesDescriptor" class="net.shibboleth.metadata.dom.saml.EntitiesDescriptorAssemblerStage" p:descriptorName="IMT-FR-Fed" > 

result in the header of my aggregated metadatas: 
<md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_5d12a60c-35a9-4120-8f28-8a4b20173ce5" Name="IMT-FR-Fed" ><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo> 

by the way, I realize that this version of aggregator-cli-0.9.2 does the signature of my aggregated metadatas (thanks to pipeline stage : <ref bean="signMetadata"/> ) 
in 0.7 I used to sign it with xmlsectool : 
./xmlsectool.sh --sign --inFile fede-unsigned.xml --outFile fede-signed.xml --certificate ../ssl/fede-cert.pem --key ../ssl/fede-key.pem 
do you confirm that this external xmlsectool signature is a duplicate and bean="signMetadata" does the same job ? 

Regarding your suggestion about relying on the EntitiesDescriptor/@Name , I don't use MDQ-style yet , but I'll keep an eye on it . 

As you suggested , I did opened a JIRA ticket do add examples : [ https://issues.shibboleth.net/jira/browse/MDA-261 | https://issues.shibboleth.net/jira/browse/MDA-261 ] 

Thanks 

Jehan 


De: "Ian Young" <ian at iay.org.uk> 
À: "Jehan PROCACCIA" <jehan.procaccia at tem-tsp.eu> 
Cc: "users" <users at shibboleth.net> 
Envoyé: Vendredi 9 Juillet 2021 17:16:11 
Objet: Re: Matadata aggregator , federation named groupID for filters 






On 2021-07-09, at 13:13, Jehan PROCACCIA < [ mailto:jehan.procaccia at tem-tsp.eu | jehan.procaccia at tem-tsp.eu ] > wrote: 

Ian.Y told me to use descriptorName property , but I cannot find this feature documented on [ https://wiki.shibboleth.net/confluence/display/MA1/Aggregate+and+Sign | https://wiki.shibboleth.net/confluence/display/MA1/Aggregate+and+Sign ] 





Detailed documentation of the individual beans is in the Javadoc. In this case, you want this: 

[ https://shibboleth.net/sites/release/java-metadata-aggregator/0.9.2/apidocs/net/shibboleth/metadata/dom/saml/EntitiesDescriptorAssemblerStage.html | https://shibboleth.net/sites/release/java-metadata-aggregator/0.9.2/apidocs/net/shibboleth/metadata/dom/saml/EntitiesDescriptorAssemblerStage.html ] 

So if you are building your aggregate using the EntitiesDescriptorAssemblerStage, you can set the descriptorName property by, for example, including p:descriptorName="myname" in its definition. 

(The documentation in Confluence currently links to the 0.10.0-SNAPSHOT Javadoc, but it's fairly similar. That might need to change.) 

There's a case to be made that we could use a lot more HOWTO examples. At the moment, a lot of the detailed stuff the MDA provides is only visible in the Javadoc, and not everyone will know how to work with that. Can you make a JIRA ticket to suggest we add an example that names an aggregate?[1] 

-- Ian 


[1] Note that, as I said before, I wouldn't really recommend relying on the EntitiesDescriptor/@Name, it doesn't scale very well. 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210709/3337699b/attachment.htm>