<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>hello</p>
<p>back to that thread nearly a year ago ... <br>
</p>
<p>I realized that by default there is no ValidUntil , nor
CacheDuration after aggregation by aggregator-cli-0.9.2<br>
</p>
<p>so I took my sample config from old aggregator-cli-0.7.0 adding
stages addValidUntil and addCacheDuration in my config file [3] +
associated beans definitions [4] <br>
</p>
<p>unfortunatly it did not create a validUntil and cacheDuration in
the main aggregator element <b>EntitiesDescriptor </b>[1] =>
this is where I want it ! , but finally appears in each individual
EntityDescriptor [2] (which I don't need) <br>
</p>
<p>is my config file ([3] / [4] ) incorrect ? <br>
</p>
<p>Thanks <br>
</p>
<p>jehan . <br>
</p>
<p>[1]</p>
<p><font size="2"><i><md:EntitiesDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_14f2b69c-b457-496c-8c36-04c8b82d2240"
Name="IMT-FR-Fededs"></i></font></p>
<p>[2]<i><font size="2"><br>
<md:EntityDescriptor ID="_13cb46776bcc41b9ac146a1bd049a3fe"
entityID=<a class="moz-txt-link-rfc2396E" href="https://campus.paristech.fr">"https://campus.paristech.fr"</a>
validUntil="2022-07-05T20:52:25.951Z"</font></i></p>
<p><br>
</p>
<p>[3]<br>
</p>
<p><i><font size="2"><bean id="main"
class="net.shibboleth.metadata.pipeline.SimplePipeline"
init-method="initialize"><br>
<property name="id" value="main"/><br>
<property name="stages"><br>
<list><br>
<ref bean="source"/><br>
<!-- <ref
bean="removeInvalidContactPerson"/> --><br>
<!-- <ref
bean="removeOrganization"/> --><br>
<b> <ref bean="addCacheDuration"/></b><b><br>
</b><b> <ref bean="addValidUntil"/></b><br>
<ref bean="createEntitiesDescriptor"/><br>
<ref bean="generateContentReferenceId"
/><br>
<!-- <ref bean="signMetadata"/>
--><br>
<ref bean="serialize" /><br>
</list></font></i></p>
<p><i><font size="2">[4]<br>
</font></i></p>
<p><i><font size="2"> <!-- jehan cache --><br>
<bean id="addCacheDuration"
class="net.shibboleth.metadata.dom.saml.SetCacheDurationStage"
p:cacheDuration="86400000"><br>
<property name="id"
value="SetCacheDurationStage" /><br>
</bean><br>
<!-- jehan validUntil --><br>
<bean id="addValidUntil"
class="net.shibboleth.metadata.dom.saml.SetValidUntilStage"
p:validityDuration="5356800000"><br>
<property name="id" value="SetValidUntilStage"
/><br>
</bean></font></i><br>
<br>
</p>
<div class="moz-cite-prefix">Le 12/07/2021 à 12:40, Ian Young a
écrit :<br>
</div>
<blockquote type="cite"
cite="mid:8076C60F-28AA-4409-9D4F-4E8D0F980719@iay.org.uk">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 2021-07-09, at 18:23, Jehan PROCACCIA <<a
href="mailto:jehan.procaccia@tem-tsp.eu"
class="moz-txt-link-freetext" moz-do-not-send="true">jehan.procaccia@tem-tsp.eu</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 12pt;" class="">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 12pt;" class="">Thanks Ian,
<div class="">setting <em class="">p:descriptorName="myname"</em>
in <em class="">EntitiesDescriptorAssemblerStage</em>
bean does the job :</div>
<div class=""><em class=""><bean
id="createEntitiesDescriptor"
class="net.shibboleth.metadata.dom.saml.EntitiesDescriptorAssemblerStage"<strong
class=""> p:descriptorName="IMT-FR-Fed"</strong>
></em></div>
<div class=""><br class="">
</div>
<div class="">result in the header of my aggregated
metadatas:</div>
<div class=""><em class=""><md:EntitiesDescriptor
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_5d12a60c-35a9-4120-8f28-8a4b20173ce5" <strong
class="">Name="IMT-FR-Fed"</strong>><Signature
xmlns="<a href="http://www.w3.org/2000/09/xmldsig"
class="moz-txt-link-freetext"
moz-do-not-send="true">http://www.w3.org/2000/09/xmldsig</a>#"><SignedInfo></em></div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Great.</div>
<div><br class="">
</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<div class="">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 12pt;" class="">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 12pt;" class="">
<div id="f254a2c9-db33-4a7f-b6f0-7316e8aa3815"
data-marker="__SIG_PRE__" class="">
<div class="">by the way, I realize that this
version of aggregator-cli-0.9.2 does the signature
of my aggregated metadatas (thanks to pipeline
stage : <ref bean="signMetadata"/> ) <br
class="">
</div>
<div class="">in 0.7 I used to sign it with
xmlsectool :</div>
<div class="">
<pre class="">./xmlsectool.sh --sign --inFile fede-unsigned.xml --outFile fede-signed.xml --certificate ../ssl/fede-cert.pem --key ../ssl/fede-key.pem </pre>
</div>
<div class="">do you confirm that this external
xmlsectool signature is a duplicate and
bean="signMetadata" does the same job ?</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>They are not identical, but as long as you're not doing
anything particularly arcane (the MDA signature stage has more
options that you can change, but you probably don't need them)
then they are close enough that you can use whichever is more
convenient.</div>
<div><br class="">
</div>
<div>In the UK federation, we use both xmlsectool and the MDA to
sign in different contexts. We use xmlsectool to sign
aggregates for a couple of reasons (aggregates are generated
on a different machine where the signing HSM is not available,
and we play some textual tricks on the aggregate XML before
signing, and those tricks can't be done using the MDA
currently) but the per-entity metadata is signed using the
MDA:</div>
<div><br class="">
</div>
<div><a
href="https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml"
class="moz-txt-link-freetext" moz-do-not-send="true">https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml</a></div>
<div><br class="">
</div>
<div><br class="">
</div>
<div>If you run into compatibility issues, where an MDQ-signed
document can't be validated by xmlsectool, this is a
(probably) bug that I haven't got to the bottom of yet; the
workround is the identity transform at <a
href="https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83"
class="moz-txt-link-freetext" moz-do-not-send="true">https://github.com/ukf/ukf-meta/blob/master/mdx/uk/mdq-multisign.xml#L81-L83</a></div>
<div><br class="">
</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<div class="">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 12pt;" class="">
<div style="font-family: arial, helvetica, sans-serif;
font-size: 12pt;" class="">
<div id="f254a2c9-db33-4a7f-b6f0-7316e8aa3815"
data-marker="__SIG_PRE__" class="">
<div class="">As you suggested , I did opened a JIRA
ticket do add examples : <a
href="https://issues.shibboleth.net/jira/browse/MDA-261"
data-mce-href="https://issues.shibboleth.net/jira/browse/MDA-261"
class="moz-txt-link-freetext"
moz-do-not-send="true">https://issues.shibboleth.net/jira/browse/MDA-261</a><br
data-mce-bogus="1" class="">
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Thanks,</div>
<div><br class="">
</div>
<div><span style="font-size: 12px; orphans: 2; widows: 2;
-webkit-text-decorations-in-effect: none;" class=""> --
Ian</span></div>
</div>
<div class=""><span class="Apple-style-span"
style="border-collapse: separate; font-variant-ligatures:
normal; font-variant-east-asian: normal;
font-variant-position: normal; line-height: normal;
border-spacing: 0px; -webkit-text-decorations-in-effect:
none;">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space;
-webkit-line-break: after-white-space;" class=""><span
class="Apple-style-span" style="border-collapse: separate;
color: rgb(0, 0, 0); font-family: Helvetica; font-size:
12px; font-style: normal; font-variant: normal;
font-weight: normal; letter-spacing: normal; line-height:
normal; orphans: 2; text-indent: 0px; text-transform:
none; white-space: normal; widows: 2; word-spacing: 0px;
border-spacing: 0px; -webkit-text-decorations-in-effect:
none; -webkit-text-stroke-width: 0px;">
<div class=""><span class="Apple-style-span"
style="font-size: medium;"><br class="">
</span></div>
</span></div>
</span><br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
</blockquote>
</body>
</html>