<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 6/12/15 12:32 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:7ACAA6C1-1F13-482E-8B02-53118534C9A9@osu.edu"
type="cite">
<pre wrap="">On 6/12/15, 12:17 PM, "users on behalf of Rob Gorrell" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofrwgorrel@uncg.edu"><users-bounces@shibboleth.net on behalf of rwgorrel@uncg.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">So is it correct that failing a signature validation on one entity will spoil things for the rest of the entity's in that same metadata provider?</pre>
</blockquote>
</blockquote>
<br>
It's not supposed to, no. What's supposed to happen is that the
element with the failed signature just gets removed.<br>
<br>
<br>
<br>
<blockquote cite="mid:7ACAA6C1-1F13-482E-8B02-53118534C9A9@osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
I would be very surprised if there was more than one signature in the file. There is no validation of an entity, the signature is what's validated. The whole file is signed.</pre>
</blockquote>
<br>
Based on this log entry and esp the line number, that's exactly what
is happening. There is a signed EntityDescriptor child of an
EntitiesDescriptor:<br>
<br>
<tt><br>
</tt><tt>11:02:00.520 - ERROR
[org.opensaml.saml2.metadata.provider.SignatureValidationFilter:254]
- EntityDescriptor
'<a class="moz-txt-link-freetext" href="https://odapilib.libraryreserve.com/FederatedAuthentication/saml/trust">https://odapilib.libraryreserve.com/FederatedAuthentication/saml/trust</a>'
failed signature verification, removing from metadata provider</tt><tt><br>
</tt><br>
<br>
And based on the next line, we likely have a bug. Something is
throwing an unchecked runtime UnsupportedOperationException.
Probably the code that attempts to remove the failed
EntityDescriptor from the parent EntitiesDescriptor:<br>
<br>
<br>
<tt>11:02:00.540 - ERROR
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:411]
- Metadata provider failed to properly initializing, halting</tt><tt><br>
</tt><tt>org.opensaml.saml2.metadata.provider.MetadataProviderException:
java.lang.UnsupportedOperationException<br>
<br>
<br>
<br>
</tt>I will attempt to reproduce with a unit test. If it's a bug, it
likely also affects v3.<br>
<br>
This is also apropos of the stuff we were just discussing in another
thread with Nate. So would be nice if it actually worked
properly... :-(<br>
<br>
<br>
<br>
</body>
</html>