<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Graham,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hopefully I'm understanding your question correctly...</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The certificate in SAML metadata is just a convenient way to convey the public key. The certificate itself is irrelevant. Some relying parties will perform TLS validation on the certificate though, so they need to be configured to trust your certificate.
In general, certificates in SAML metadata should be long-lived and self-signed. See SDP-MD05 in the SAML V2.0 Interoperability Deployment Profile (<a href="https://kantarainitiative.github.io/SAMLprofiles/saml2int.html#_metadata_and_trust_management">https://kantarainitiative.github.io/SAMLprofiles/saml2int.html#_metadata_and_trust_management</a>).<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Graham Leggett <minfrin@sharp.fm><br>
<b>Sent:</b> Monday, July 29, 2019 9:20 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> OpenSAML and XML signatures: Handling intermediate certificates - how?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Hi all,<br>
<br>
I am currently trying to get pac4j-saml (which integrates with java-opensaml) to interoperate with ADFS using the KeyStoreCredentialResolver.<br>
<br>
While the KeyStore (a P12 file in this case) contains intermediate certificates, only the first certificate in the store is added to the SAML2 metadata:<br>
<br>
<a href="https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java;h=77b2a7081e8748bc2c867a7b39a4ae0a4987b756;hb=HEAD#l229">https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-security-impl/src/main/java/org/opensaml/security/credential/impl/KeyStoreCredentialResolver.java;h=77b2a7081e8748bc2c867a7b39a4ae0a4987b756;hb=HEAD#l229</a><br>
<br>
ADFS complains that the certificate chain is not trusted, which is 100% true - the intermediate certs are missing, and so there is no way ADFS could verify our certificate.<br>
<br>
My question is - what changes do I need to make to read intermediate certificates from the KeyStore and add these intermediate certificates to the SAML2 metadata endpoint?<br>
<br>
Is the metadata endpoint supposed to carry the leaf certificate and the intermediates, or just the leaf certificate and have the intermediates in the actual SAML messages, or should it contain the root certificate to be trusted?<br>
<br>
I've drawn a blank reading the specs, as they refer to XMLSIG but in a general sense, and I need the specifics.<br>
<br>
Regards,<br>
Graham<br>
—<br>
<br>
</div>
</span></font></div>
</div>
</body>
</html>