<div dir="ltr"><div><span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">What I put for my original metadata-rpovider was a poor copy/paste, sorry.</span></div><div><span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><span style="font-size:small;text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">When I configure my metadata provider like so:</span><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><MetadataProvider id="LocalEntityMetadataCRC" xsi:type="<wbr>FilesystemMetadataProvider"<br> metadataFile="/opt/shibboleth-<wbr>idp/metadata/meta-cert2.xml"><br></MetadataProvider></blockquote><div><br></div><div>It's able to resolve it, per the logs</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Metadata Resolver FilesystemMetadataResolver LocalEntityMetadataCRC: Resolved 1 candidates via EntityIdCriterion: EntityIdCriterion [id=<a href="https://mysp.net/rest/v2/sso/message/shibboleth/metadata" target="_blank" style="color:rgb(17,85,204)">https://mySP.net/rest/v2/<wbr>sso/message/shibboleth/<wbr>metadata</a>] </blockquote><div><br></div>If I recall correctly, this is because there are no configured child elements so it falls back to using the well-known location strategy (which I guess means it uses the entityID? Unless falling back to the well-known location strategy is just for <wbr>DynamicHTTPMetadataProvider where that warning about lack of child filters is documented). But I would like to configure the metadata provider with SignatureValidation. So I configured the metadata-provider thusly:</div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><br></div><div style="font-size:small;text-decoration-style:initial;text-decoration-color:initial"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><MetadataProvider id="LocalEntityMetadataCRC" xsi:type="<wbr>FilesystemMetadataProvider"<br> metadataFile="/opt/shibboleth-<wbr>idp/metadata/meta-cert2.xml"><br> <MetadataFilter xsi:type="SignatureValidation" certificateFile="%{idp.home}/<wbr>credentials/cert.pem" /><br></MetadataProvider></blockquote><div><br></div><div>And the logs tell me this:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Metadata Resolver FilesystemMetadataResolver LocalEntityMetadataCRC: Metadata backing store does not contain any EntityDescriptors with the ID:<span> </span><a href="https://mysp.net/rest/v2/sso/message/shibboleth/metadata" target="_blank" style="color:rgb(17,85,204)">https://mySP.net/rest/v2/sso/<wbr>message/shibboleth/metadata</a></blockquote><div> </div><div>So what's happening here? The cert.pem contains the public key that was used to sign the metadata. If it's not using the entityID anymore because of the presence of a child element, and it's not using the ID in the metadata, what is it using? What's the big giant elephant I'm missing?</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Aug 6, 2018 at 2:18 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> No, you're interpreting that too literally. Metadata lookup (at least in all the<br>
> basic and common cases) is by entityID. Additionally, the ID attrib in<br>
> metadata is usually a transient value, generated and assigned anew on each<br>
> new document "version", and as such there is no way that it could be used as<br>
> the basis for looking it up by another party, since there's practically speaking<br>
> no way they would or could know it in advance.<br>
<br>
</span>Metadata's much looser, it can definitely be a fixed value, that's not unusual. It's just the signature anchor. I would probably suggest we clean up that message, though it's true it hasn’t really come up before.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><p><br>
<br>
<img alt="" longdesc="https://ci3.googleusercontent.com/proxy/7vsBkuOy6ytSYqTS8t3aHsDYWhe-flv3eqHZBodSDhU8ffh8DNSWwR1Q2JIuYmRH_Tc4_Pt4QwhwCta1PkpgVb8Qqi-VHrs=s0-d-e1-ft#http://voalte.com/uploads/images/voalteemail3.png" src="http://voalte.com/uploads/images/voalteemail3.png" style="font-family:Times;font-size:medium;margin-left:14px;margin-right:14px;float:left;width:90px;height:75px;margin-top:10px;background-color:rgba(255,255,255,0.921569)"><span style="font-family:arial,helvetica,sans-serif"><span style="font-size:14px"><strong>Cody<span style="font-weight:bold;background-color:rgba(255,255,255,0.917969)"> </span>Carmichael<span style="background-color:rgba(255,255,255,0.917969);font-weight:bold"> </span></strong><br>Engineering Operations <span style="background-color:rgba(255,255,255,0.917969)"> | Voalte</span><br>
<span style="background-color:rgba(255,255,255,0.917969)">Office: 941-312-2830 | Ext </span></span></span><br>
<span style="font-family:arial,helvetica,sans-serif"><span style="font-size:14px;background-color:rgba(255,255,255,0.917969)">Email: </span></span><a href="mailto:ccarmichael@voalte.com" target="_blank">ccarmichael@voalte.com</a><br> </p><p><a href="http://www.voalte.com/klas-report-classifies-voalte-as-a-strategic-solution-provider-with-the-most-robust-interfacing/" target="_blank"></a><a href="http://www.voalte.com/klas-report-classifies-voalte-as-a-strategic-solution-provider-with-the-most-robust-interfacing/" target="_blank"></a><a href="http://www2.voalte.com/l/8232/2017-01-30/6k3skb" target="_blank"><img src="http://www2.voalte.com/l/8232/2017-01-30/6k3sjj/8232/170767/Voalte_Email_Signature.png"></a> </p></div></div></div>
</div>