<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Le 29/06/2020 à 16:03, Peter Schober a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:20200629140355.tfx3fxyrvd5umxie@aco.net">
<pre class="moz-quote-pre" wrap="">* Jehan Procaccia <a class="moz-txt-link-rfc2396E" href="mailto:jehan.procaccia@tem-tsp.eu"><jehan.procaccia@tem-tsp.eu></a> [2020-06-29 15:33]:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">is the trust in signature failing because of the "Federation"
aggregation signing (which I doubt beacause when I remove that
specific SP , others aggreted don't complained ) or because of that
specific SP embeded certificate/sign-keys ?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Not "because of that specific SP embeded certificate/sign-keys", but
"because of that specific SP's embeded Signature element", AFAIU.
I.e., if you're adding individually signed entities to your local
aggregate I'd remove the signatures from all entities (possibly after
first validating it, if that makes sense, e.g. if you recieved a
trustworthy copy of the verification certificate out of bounds) except
for the enclosing EntitiesDescriptor one.
(All metadata consumers should be able to verify all included
Signatures on any entities. If that cannot be ensured you should
remove those signatures.)
-peter
</pre>
</blockquote>
<p>OK I removed the Signature element :</p>
<p><ds:Signature xmlns:ds="<a class="moz-txt-link-freetext" href="http://www.w3.org">http://www.w3.org</a> ...
<ds:SignatureValue>Cu8YF...ODA=</ds:SignatureValue>
</ds:KeyInfo> </ds:Signature></p>
<p> from that specific SP's, and kept signing myself the agregate
(in this case for that only one SP) <br>
</p>
<p><i>./xmlsectool.sh --sign --inFile
fede-imt-ext-recruitee-unsigned.xml --outFile
Downloads/fede-imt-ext-recruitee-signed.xml --certificate
../ssl/fede-cert.pem --key ../ssl/fede-key.pem</i><br>
</p>
<p>and now it does load ;-) </p>
<p><i>2020-06-29 23:24:23,221 - INFO
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:465]
- Metadata Resolver FileBackedHTTPMetadataResolver
fedeIMTextRecruitee: New metadata successfully loaded for
'<a class="moz-txt-link-freetext" href="https://federation.mydomain.eu/metadata/fede-imt-ext-recruitee-signed.xml">https://federation.mydomain.eu/metadata/fede-imt-ext-recruitee-signed.xml</a>'</i><i><br>
</i></p>
<p>Thanks a lot for the help . <br>
</p>
<p>is there a security issue by removing that SP own/embeded
signature (provider by the partner) , as long as I resign it on my
side with my "federation-agregrate" ? <br>
</p>
<p>regards . <i><br>
</i></p>
<br>
</body>
</html>