<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Ian, Peter,<br>
<br>
it is not present in our aggregated metadata for the moment till I
find a way to figure what it the problem is with the DS..<br>
<br>
I completely agree with you over the validity of this element in the
SP's metadata. I've asked to the SP's operator to strip it of its
metadata as it is completely useless to have it, but apparently he
didn't seem to understand what was wrong using a self signed
certificate in this case.<br>
<br>
Anyway, I will once more try to give him arguments to remove it from
his metadata.<br>
<br>
pascal<br>
<br>
<div class="moz-cite-prefix">On 20/06/13 12:57, Ian Young wrote:<br>
</div>
<blockquote
cite="mid:7745B131-311A-42F3-B7F2-73206DF015C7@iay.org.uk"
type="cite">
<pre wrap="">
On 20 Jun 2013, at 10:24, Pascal Panneels <a class="moz-txt-link-rfc2396E" href="mailto:pascal.panneels@belnet.be"><pascal.panneels@belnet.be></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">We are now encountering some problems with new SP connecting to our federation.
</pre>
</blockquote>
<pre wrap="">
I took a quick peek at the belnet metadata but couldn't see the entity in question. I'll assume that what has happened is that a new SP has come along with metadata for their entity that is signed, and that EntityDescriptor signature has been republished as-is.
</pre>
<blockquote type="cite">
<pre wrap="">The problematic SP have a <ds:signature> section in their metadata; while syntactically correct, their metadata is rejected by the DS with following messages in the log :
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I know that the certificate present in their metadata is a self-signed. Is that the cause of the problem ?
</pre>
</blockquote>
<pre wrap="">
I think the deeper question is why the metadata signature on the individual entity is being republished by your federation. As such a signature would become invalid as soon as the republished metadata changed in any way whatsoever, it is much more likely to cause problems. I can't imagine that your federation would normally agree to republish metadata from a member with absolutely no changes, for example. If they make ANY changes, the signature won't verify.
Peter's also right in questioning what such a signature would actually mean. A random key wrapped in a self-signed certificate signs something: if you have no reason to trust that key, what point is there in the signature?
There are some circumstances (e.g., signed entity attributes) where passing along a third-party signature within metadata makes sense (and for all I know the CDS would have a problem with that too), but a signature at the EntityDescriptor level is largely an integrity check, and should be discarded (or recomputed) on republication.
</pre>
<blockquote type="cite">
<pre wrap="">Is there a tool in the Shibboleth stuff to help me verify the signature of the metadata "by hand" (I mean using command line...) ?
</pre>
</blockquote>
<pre wrap="">
XmlSecTool would be one option:
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/XmlSecTool">https://wiki.shibboleth.net/confluence/display/SHIB2/XmlSecTool</a>
Or, there's a samlsign tool bundled with a part of the SP install, if you have that.
However, I don't think this really helps; the issue is that the extra brittle self-signed signature should probably not be there in the first place.
-- Ian
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<b><font size="2" color="#0092D2" face="arial">Pascal Panneels</font></b><font
size="2" color="#0092D2" face="arial"><br>
Project Manager<br>
Belnet • Services</font>
<font size="2" color="#8B8E8D" face="arial"><br>
Louizalaan 231 Avenue Louise<br>
Brussel 1050 Bruxelles
<br>
België • Belgique<br>
T: +32 2 790 33 33
<br>
<b><a href="http://www.belnet.be"
style="text-decoration:none;color:#0092D2">www.belnet.be</a></b><br>
</font></div>
</body>
</html>