Can the MDA add entity attributes?

[Ian Young]

> On 10 Sep 2024, at 17:35, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> Now, I have another odd problem. I’ve been signing my metadata with xmlsectool for over a decade. I’m now trying to sign it with the MDA. Using the same key and cert pair that I’ve been using with xmlsectool, the MDA is signing it, but signature validation with anything (xmlsectool, the IdP, etc.) is failing. Any thoughts on why based on this limited information or suggestions how I might go about troubleshooting this further?


If your pipeline loads an aggregate, breaks it down, manipulates it and then assembles a new aggregate and signs that (a very common pattern) then it's possible that you've hit this long-standing issue from deep in the bowels of the JDK's DOM handling:

   https://shibboleth.atlassian.net/browse/MDA-144

That's fixed for 1.0.0, and if you acquire a snapshot it may fix your issue; I'd appreciate a confirmation if that turns out to be the case.

It's also possible to bypass this issue by doing _any_ XSL transform on the metadata, at any point between the disassembly and assembly stages; even an identity transform will do it as the serialiser in _that_ part of the JDK does the right thing. That effect is why at least some production deployments never ran into the problem.

If that's not your problem, I would of course be very interested in digging deeper: my intention is to move to a 1.0.0 release before we all get much older, and shaking out problems like this is therefore important.

Cheers,

    -- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4151 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240910/d762e8cc/attachment.p7s>