<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 6/8/15 7:24 AM, Nate Klingenstein
wrote:<br>
</div>
<blockquote
cite="mid:917CA4CB-A8D3-4465-B432-DB484C235F49@internet2.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">So the utility of the requireSignedMetadata/requireSignature attribs is the use case where the root is *not* expected to be signed, but 1 or more child elements *are* expected to be signed, and you still obviously need to validate signatures on those (otherwise you wouldn't bother configuring in the signature validation filter on that metadata in the first place). As one example, think of a use case where the root is an EntitiesDescriptor which is merely a simple (non-signed) aggregation of signed EntityDescriptors obtained from elsewhere.
</pre>
</blockquote>
<pre wrap="">
That all makes sense, but it strikes me as something of an edge case. </pre>
</blockquote>
<br>
Definitely it is.<br>
<br>
<br>
<blockquote
cite="mid:917CA4CB-A8D3-4465-B432-DB484C235F49@internet2.edu"
type="cite">
<pre wrap=""> Is there a way to specify that you want a particular entity to be signed, for example, or could you only do this on the root?</pre>
</blockquote>
<br>
No. The root is easy because it's in an absolute position.
However, being able to arbitrarily specify which children must be
signed would probably require an XPath-like syntax for trees of
XMLObjects. Believe it or not, Chad once asked me to look into
supporting that general capability, for some other reason.... It's
difficult. I think there was a library that purported to support
expressions on arbitrary object graphs, but it was going to be a lot
of work to implement. It would sound pretty heinous for a deployer
to configure in any case.<br>
<br>
One thing that might be doable is to specify that any metadata that
passes the signature filter has to be "in the scope of" of a
signature, otherwise it gets removed. So if the root isn't signed,
then e.g. any direct child EntityDescriptors must be signed. And I
think effectively that really applies to Entity- and
EntitiesDescriptors mostly. I don't think one could meaningfully
support signed RoleDescriptors and AffiliationDescriptors where the
parent EntityDescriptor was neither signed nor in the scope of a
signed EntitiesDescriptor.<br>
<br>
<br>
<blockquote
cite="mid:917CA4CB-A8D3-4465-B432-DB484C235F49@internet2.edu"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">The signing key is for the whole metadata document. The root may or may not be signed, but doesn't have anything to do with whether any other validation is going to happen.
</pre>
</blockquote>
<pre wrap="">
This is the most interesting thing that you wrote, to me. I wonder whether this is going to create questions for future use cases where we're trying to support multiple signatures.
</pre>
</blockquote>
<br>
As you've already raised later in the thread, there's definitely
questions/issues for actually doing this sort of thing.<br>
</body>
</html>