<div dir="ltr"><div><div><div><div><div><div><div><div>Thank you again for the precious information.<br><br></div>I chose to aggregate myself all metadata to build my own federation.<br></div><div>Please let me know if my following understanding is right :<br>
<br></div>Every client who wants to be part of my federation will upload their metadata containing an EntityDescriptor<br></div>I will read and validate the uploaded file against the schema ad then insert the EntityDescriptor inside my federation metadata file as this :<br>
</div><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><EntitiesDescriptor ...><br> <EntityDescriptor ><br> ...<br> </EntityDescriptor ><br>
<EntityDescriptor ><br> ...<br> </EntityDescriptor ><br><br></EntitiesDescriptor><br></blockquote>
<br></div>The file described above is loaded by shibboleth specifying the following in the main conf file shibboleth2.xml :<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">
<MetadataProvider type="XML" file="pathToMyFederationMetadataFile/allMetadata.xml"/><br></blockquote>
<br></div>It works fine as long as I specify only one EntityDescriptor inside the <EntitiesDescriptor><br></div>When there are more, the file is correctly loaded at startup but the TrustEngine cannot retrieve the certificate for other EntitiesDescriptor but the first specified.<br>
</div>See the trace below :<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolving ds:X509Certificate<br>
2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 1 certificate(s)<br>2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 0 CRL(s)<br>2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolving ds:X509Certificate<br>
2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 1 certificate(s)<br>2014-08-21 16:27:13 DEBUG XMLTooling.KeyInfoResolver.Inline [1]: resolved 0 CRL(s)<br>2014-08-21 16:27:13 DEBUG XMLTooling.CredentialCriteria [1]: keys didn't match<br>
2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.ExplicitKey [1]: unable to validate signature, no credentials available from peer<br>2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: validating signature using certificate from within the signature<br>
2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: signature verified with key inside signature, attempting certificate validation...<br>2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: checking that the certificate name is acceptable<br>
2014-08-21 16:27:13 DEBUG XMLTooling.CredentialCriteria [1]: keys didn't match<br>2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: certificate subject: CN=ADFS Signing - exchange2010.exchangetest.local<br>2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match DN, trying TLS subjectAltName match<br>
2014-08-21 16:27:13 DEBUG XMLTooling.TrustEngine.PKIX [1]: unable to match subjectAltName, trying TLS CN match<br>2014-08-21 16:27:13 ERROR XMLTooling.TrustEngine.PKIX [1]: certificate name was not acceptable<br>2014-08-21 16:27:13 ERROR OpenSAML.SecurityPolicyRule.XMLSigning [1]: unable to verify message signature with supplied trust engine<br>
</blockquote><div><br></div><div>Do you have an idea on what I'm doing wrong ?<br> <br></div><br><br></div>