<div>From the MetadataFilter documentation (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter</a>), under the Signature MetadataFilter, TrustEngine:</div>
<div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><br></span></div><div><span class="Apple-style-span" style="background-color:rgb(255,255,255)">"</span><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)">Allows signatures to be validated using the more comprehensive trust engine interface, which allows for a richer interpretation of signature and key information. By default, the name of the entity over which a signature is being verified is used as the required certificate name for trust engines that verify credential names."</span></div>
<div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><br></span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)">If the default is the entity id, how would one override/extend the default?</span></div>
<div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><br></span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)">Also, my requirement is to verify CA certification path (single CA) and CRL on the signature? Any way to combine those, in addition with the name verification? I haven't been able to configure it in an way that works? I don't have control over the incoming metadata and the inclusion of Shibboleth-specific extensions, therefore I am using StaticPKIX. If the metadata is maintained locally, I do have the option of extracting the signature and verifying against the cert (and its name) directly... but I also need CRL checking, hence ExplicitKey or direct certificate="signer-cert.pem" on the MetadataFilter doesn't seem to be an option (the TrustEngine seems to be ignored if I use the latter approach).</span></div>
<div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><br></span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)">An example of what works is below. </span></div>
<div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><br></span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><div>
<MetadataProvider type="XML" file="sp-metadata.xml" id="sp1"></div><div> <MetadataFilter type="Signature" verifyName="false"></div><div> <TrustEngine type="StaticPKIX"></div>
<div> <CredentialResolver type="File"></div><div> <Certificate><Path>ca-cert.pem</Path></Certificate></div><div> <CRL><Path>crl.der</Path></CRL></div>
<div> </CredentialResolver></div><div> </TrustEngine></div><div> </MetadataFilter></div><div> </MetadataProvider></div><div><br></div></span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:13px;line-height:17px;background-color:rgb(255,255,255)"><br>
</span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;line-height:17px">Environment: Shibboleth SP 2.4.3, RHEL 5 x86_64, compiled from source.</span></div><div>
<span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;line-height:17px"><br></span></div><div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;line-height:17px">Thanks in advance,</span></div>
<div><span class="Apple-style-span" style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;line-height:17px">Marc</span></div>