Matadata aggregator , federation named groupID for filters

[jehan.procaccia at tem-tsp.eu]

hello

back to that thread nearly a year ago ...

I realized that by default there is no ValidUntil , nor CacheDuration 
after aggregation by aggregator-cli-0.9.2

so I took my sample config from old aggregator-cli-0.7.0  adding stages 
addValidUntil and addCacheDuration in my config file [3] + associated 
beans definitions [4]

unfortunatly it did not create a validUntil and cacheDuration in the 
main aggregator element *EntitiesDescriptor *[1]  => this is where I 
want it ! , but finally appears in each individual EntityDescriptor [2] 
(which I don't need)

is my config file ([3] / [4] ) incorrect  ?

Thanks

jehan .

[1]

/<md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" 
ID="_14f2b69c-b457-496c-8c36-04c8b82d2240" Name="IMT-FR-Fededs">/

[2]/
<md:EntityDescriptor ID="_13cb46776bcc41b9ac146a1bd049a3fe" 
entityID="https://campus.paristech.fr" 
validUntil="2022-07-05T20:52:25.951Z"/


[3]

/<bean id="main" class="net.shibboleth.metadata.pipeline.SimplePipeline" 
init-method="initialize">
         <property name="id" value="main"/>
         <property name="stages">
             <list>
                 <ref bean="source"/>
                 <!-- <ref bean="removeInvalidContactPerson"/> -->
                 <!--    <ref bean="removeOrganization"/> -->
*     <ref bean="addCacheDuration"/>**
**                <ref bean="addValidUntil"/>*
                 <ref bean="createEntitiesDescriptor"/>
                 <ref bean="generateContentReferenceId" />
                 <!-- <ref bean="signMetadata"/> -->
                 <ref bean="serialize" />
             </list>/

/[4]
/

/ <!-- jehan cache -->
    <bean id="addCacheDuration" 
class="net.shibboleth.metadata.dom.saml.SetCacheDurationStage" 
p:cacheDuration="86400000">
            <property name="id" value="SetCacheDurationStage" />
    </bean>
     <!-- jehan validUntil -->
    <bean id="addValidUntil" 
class="net.shibboleth.metadata.dom.saml.SetValidUntilStage" 
p:validityDuration="5356800000">
            <property name="id" value="SetValidUntilStage" />
    </bean>/

Le 12/07/2021 à 12:40, Ian Young a écrit :
>
>
>> On 2021-07-09, at 18:23, Jehan PROCACCIA <jehan.procaccia at tem-tsp.eu> 
>> wrote:
>>
>> Thanks Ian,
>> setting /p:descriptorName="myname"/ in 
>> /EntitiesDescriptorAssemblerStage/ bean does the job :
>> /<bean id="createEntitiesDescriptor" 
>> class="net.shibboleth.metadata.dom.saml.EntitiesDescriptorAssemblerStage"*p:descriptorName="IMT-FR-Fed"* 
>> >/
>>
>> result in the header of my aggregated metadatas:
>> /<md:EntitiesDescriptor 
>> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" 
>> ID="_5d12a60c-35a9-4120-8f28-8a4b20173ce5" 
>> *Name="IMT-FR-Fed"*><Signature 
>> xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo>/
>
> Great.
>
>
>> by the way, I realize that this version of aggregator-cli-0.9.2 does 
>> the signature of my aggregated metadatas (thanks to  pipeline stage : 
>> <ref bean="signMetadata"/> )
>> in 0.7 I used to sign it with xmlsectool :
>> ./xmlsectool.sh --sign --inFile fede-unsigned.xml --outFile fede-signed.xml --certificate ../ssl/fede-cert.pem --key ../ssl/fede-key.pem
>> do you confirm that this external xmlsectool signature is a duplicate 
>> and bean="signMetadata" does the same job ?
>
> They are not identical, but as long as you're not doing anything 
> particularly arcane (the MDA signature stage has more options that you 
> can change, but you probably don't need them) then they are close 
> enough that you can use whichever is more convenient.
>
> In the UK federation, we use both xmlsectool and the MDA to sign in 
> different contexts. We use xmlsectool to sign aggregates for a couple 
> of reasons (aggregates are generated on a different machine where the 
> signing HSM is not available, and we play some textual tricks on the 
> aggregate XML before signing, and those tricks can't be done using the 
> MDA currently) but the per-entity metadata is signed using the MDA:
>
> https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml
>
>
> If you run into compatibility issues, where an MDQ-signed document 
> can't be validated by xmlsectool, this is a (probably) bug that I 
> haven't got to the bottom of yet; the workround is the identity 
> transform at 
> https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83
>
>
>> As you suggested , I did opened a JIRA ticket do add examples : 
>> https://issues.shibboleth.net/jira/browse/MDA-261
>
> Thanks,
>
>     -- Ian
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220504/d38f86a6/attachment.htm>