The Shibboleth IdP V4 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP5 wiki space for current documentation on the supported version.
SignatureValidationFilter
- Scott Cantor
- Rod Widdowson
- Brent Putman
Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
Overview
The SignatureValidation filter verifies that a metadata instance is signed correctly with a trusted key, and is the linchpin of the security of most Shibboleth deployments.
The "Sign and Expire" distribution model
In practice, a SignatureValidation filter and a RequiredValidUntilFilter filter are often used together to securely obtain remote metadata via HTTP. See the FileBackedHTTPMetadataProvider and DynamicHTTPMetadataProvider topics for explicit configuration examples. Other distribution models are discussed in the TrustManagement topic.
There are four approaches to supplying a trust policy to the SignatureValidation filter:
A pointer to a certificate file
A reference to an externally defined TrustEngine bean
An inline
<PublicKey>elementAn inline
<security:TrustEngine>element
Filter order is important!
In the overall sequence of filters, a filter of type SignatureValidation must appear before any filter that alters the metadata instance. Examples of the latter include EntityAttributesFilter, EntityRoleFilter, NameIDFormatFilter, and PredicateMetadataFilter .