Sibboleth SP v3.x Metadata Signature validation using PKIX trust engine question

[Pieter van der Meulen]

Hi,

I'm trying to figure out how to best configure a Shibboleth 3.x SP to validate SAML Metadata that is signed using a signing certificate that is issues by a CA. I can get it to work, but only if I add the CN or the DN of the actual metadata signing certificate to the TrustEngine using TrustedName. I.e.:

<MetadataProvider type="XML" validate="true" url="https://metadata.surfconext.nl/signed/2023/idp-metadata.xml" backingFilePath="surfconext-prod-idp-metadata.xml" maxRefreshDelay="7200">
   <MetadataFilter type="Signature">
       <TrustEngine type="StaticPKIX" certificate="SURFconext-metadata-CA-2023.pem" verifyDepth="2" policyMappingInhibit="true" anyPolicyInhibit="true">
           <TrustedName>SURFconext metadata signing 2023.0</TrustedName>
       </TrustEngine>
   </MetadataFilter>
</MetadataProvider>


If I do not add the TrustedName, I get an "certificate name was not acceptable" error from shibd for the metadata signing certificate:

2023-11-10 10:28:14 INFO OpenSAML.MetadataProvider : building MetadataFilter of type Signature
2023-11-10 10:28:14 INFO XMLTooling.SecurityHelper : loading certificate(s) from file (/etc/shibboleth/SURFconext-metadata-CA-2023.pem)
2023-11-10 10:28:14 INFO XMLTooling.CredentialResolver.File : no private key resolved, usable for verification/trust only
2023-11-10 10:28:14 DEBUG OpenSAML.MetadataProvider.XML : using local resource (/etc/shibboleth/surfconext-metadata.xml), will monitor for changes
2023-11-10 10:28:14 DEBUG OpenSAML.MetadataProvider.XML : loading configuration from external resource...
2023-11-10 10:28:14 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (/etc/shibboleth/surfconext-metadata.xml)
2023-11-10 10:28:14 DEBUG XMLTooling.Signature : unmarshalling ds:Signature
2023-11-10 10:28:14 INFO OpenSAML.MetadataProvider : applying metadata filter (Signature)
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : validating signature using certificate from within the signature
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : signature verified with key inside signature, attempting certificate validation...
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : checking that the certificate name is acceptable
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : adding to list of trusted names (https://engine.surfconext.nl/authentication/idp/metadata)
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : certificate subject: CN=SURFconext metadata signing 2023.0,OU=SURFconext,O=SURF B.V.,ST=Utrecht,L=Utrecht,C=NL
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : unable to match DN, trying TLS subjectAltName match
2023-11-10 10:28:14 DEBUG XMLTooling.TrustEngine.PKIX : unable to match subjectAltName, trying TLS CN match
2023-11-10 10:28:14 ERROR XMLTooling.TrustEngine.PKIX : certificate name was not acceptable
2023-11-10 10:28:14 WARN OpenSAML.MetadataFilter.Signature : filtering out entity at root of instance after failed signature check: TrustEngine unable to verify signature.
2023-11-10 10:28:14 CRIT Shibboleth.Application : error initializing MetadataProvider: SignatureMetadataFilter unable to verify signature at root of metadata instance.


It appears that the signing certificate must be explicitly whitelisted and that it being issued by a trusted CA is not enough. This means that when we switch to a new signing certificate, the shibd config has to be updated, which is not ideal. 

My questions:
1. Is there a better way of configuring shibd for this kind of metadata signature validation?
2. What is the idea behind this behaviour of the PKIX TrustEngine?

The metadata and CA certificate being used can be found at https://metadata.surfconext.nl/signed.html


Kind regards,

Pieter.
--
Pieter van der Meulen (Pieter.vanderMeulen at surf.nl)
SURF - Trust and Identity


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4325 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20231110/0b7c072a/attachment.p7s>