Matadata aggregator , federation named groupID for filters

[Ian Young]

> On 2021-07-09, at 18:23, Jehan PROCACCIA <jehan.procaccia at tem-tsp.eu> wrote:
> 
> Thanks Ian,
> setting p:descriptorName="myname" in EntitiesDescriptorAssemblerStage bean does the job :
> <bean id="createEntitiesDescriptor" class="net.shibboleth.metadata.dom.saml.EntitiesDescriptorAssemblerStage" p:descriptorName="IMT-FR-Fed" >
> 
> result in the header of my aggregated metadatas:
> <md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_5d12a60c-35a9-4120-8f28-8a4b20173ce5" Name="IMT-FR-Fed"><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo>

Great.


> by the way, I realize that this version of aggregator-cli-0.9.2 does the signature of my aggregated metadatas (thanks to  pipeline stage : <ref bean="signMetadata"/> ) 
> in 0.7 I used to sign it with xmlsectool :
> ./xmlsectool.sh --sign --inFile fede-unsigned.xml --outFile fede-signed.xml --certificate ../ssl/fede-cert.pem --key ../ssl/fede-key.pem 
> do you confirm that this external xmlsectool signature is a duplicate and bean="signMetadata" does the same job ?

They are not identical, but as long as you're not doing anything particularly arcane (the MDA signature stage has more options that you can change, but you probably don't need them) then they are close enough that you can use whichever is more convenient.

In the UK federation, we use both xmlsectool and the MDA to sign in different contexts. We use xmlsectool to sign aggregates for a couple of reasons (aggregates are generated on a different machine where the signing HSM is not available, and we play some textual tricks on the aggregate XML before signing, and those tricks can't be done using the MDA currently) but the per-entity metadata is signed using the MDA:

https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml <https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml>


If you run into compatibility issues, where an MDQ-signed document can't be validated by xmlsectool, this is a (probably) bug that I haven't got to the bottom of yet; the workround is the identity transform at https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83 <https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83>


> As you suggested , I did opened a JIRA ticket do add examples : https://issues.shibboleth.net/jira/browse/MDA-261 <https://issues.shibboleth.net/jira/browse/MDA-261>

Thanks,

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210712/bd370efe/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210712/bd370efe/attachment.p7s>