<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 2021-07-09, at 18:23, Jehan PROCACCIA <<a href="mailto:jehan.procaccia@tem-tsp.eu" class="">jehan.procaccia@tem-tsp.eu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class=""><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class="">Thanks Ian,<div class="">setting <em class="">p:descriptorName="myname"</em> in <em class="">EntitiesDescriptorAssemblerStage</em> bean does the job :</div><div class=""><em class=""><bean id="createEntitiesDescriptor" class="net.shibboleth.metadata.dom.saml.EntitiesDescriptorAssemblerStage"<strong class=""> p:descriptorName="IMT-FR-Fed"</strong> ></em></div><div class=""><br class=""></div><div class="">result in the header of my aggregated metadatas:</div><div class=""><em class=""><md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_5d12a60c-35a9-4120-8f28-8a4b20173ce5" <strong class="">Name="IMT-FR-Fed"</strong>><Signature xmlns="<a href="http://www.w3.org/2000/09/xmldsig" class="">http://www.w3.org/2000/09/xmldsig</a>#"><SignedInfo></em></div></div></div></div></div></blockquote><div><br class=""></div><div>Great.</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class=""><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class=""><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class=""><div id="f254a2c9-db33-4a7f-b6f0-7316e8aa3815" data-marker="__SIG_PRE__" class=""><div class="">by the way, I realize that this version of aggregator-cli-0.9.2 does the signature of my aggregated metadatas (thanks to pipeline stage : <ref bean="signMetadata"/> ) <br class=""></div><div class="">in 0.7 I used to sign it with xmlsectool :</div><div class=""><pre class="">./xmlsectool.sh --sign --inFile fede-unsigned.xml --outFile fede-signed.xml --certificate ../ssl/fede-cert.pem --key ../ssl/fede-key.pem </pre></div><div class="">do you confirm that this external xmlsectool signature is a duplicate and bean="signMetadata" does the same job ?</div></div></div></div></div></div></blockquote><div><br class=""></div><div>They are not identical, but as long as you're not doing anything particularly arcane (the MDA signature stage has more options that you can change, but you probably don't need them) then they are close enough that you can use whichever is more convenient.</div><div><br class=""></div><div>In the UK federation, we use both xmlsectool and the MDA to sign in different contexts. We use xmlsectool to sign aggregates for a couple of reasons (aggregates are generated on a different machine where the signing HSM is not available, and we play some textual tricks on the aggregate XML before signing, and those tricks can't be done using the MDA currently) but the per-entity metadata is signed using the MDA:</div><div><br class=""></div><div><a href="https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml" class="">https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml</a></div><div><br class=""></div><div><br class=""></div><div>If you run into compatibility issues, where an MDQ-signed document can't be validated by xmlsectool, this is a (probably) bug that I haven't got to the bottom of yet; the workround is the identity transform at <a href="https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83" class="">https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83</a></div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class=""><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class=""><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;" class=""><div id="f254a2c9-db33-4a7f-b6f0-7316e8aa3815" data-marker="__SIG_PRE__" class=""><div class="">As you suggested , I did opened a JIRA ticket do add examples : <a href="https://issues.shibboleth.net/jira/browse/MDA-261" data-mce-href="https://issues.shibboleth.net/jira/browse/MDA-261" class="">https://issues.shibboleth.net/jira/browse/MDA-261</a><br data-mce-bogus="1" class=""></div></div></div></div></div></div></blockquote><div><br class=""></div><div>Thanks,</div><div><br class=""></div><div><span style="font-size: 12px; orphans: 2; widows: 2; -webkit-text-decorations-in-effect: none;" class=""> -- Ian</span></div></div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px; -webkit-text-decorations-in-effect: none;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""><span class="Apple-style-span" style="font-size: medium;"><br class=""></span></div></span></div></span><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>