{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Namespace:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"urn:mace:shibboleth:2.0:metadata","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Schema:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"http://shibboleth.net/schema/idp/shibboleth-metadata.xsd","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}},{"type":"link","attrs":{"href":"http://shibboleth.net/schema/idp/shibboleth-metadata.xsd"}}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"2cf25202-cd2a-469d-88be-8f4056116933"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"2723483f-8c0e-4d5a-84d1-20061c851c36"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"SignatureValidation","type":"text","marks":[{"type":"code"}]},{"text":" filter verifies that a metadata instance is signed correctly with a trusted key, and is the linchpin of the security of most Shibboleth deployments.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"The \"Sign and Expire\" distribution model","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"In practice, a ","type":"text"},{"text":"SignatureValidation","type":"text","marks":[{"type":"code"}]},{"text":" filter and a ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631652"}},{"text":" filter are often used together to securely obtain remote metadata via HTTP. See the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631639"}},{"text":" and ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631638"}},{"text":" topics for explicit configuration examples. Other distribution models are discussed in the ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645130"}},{"text":" topic.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"There are four approaches to supplying a trust policy to the ","type":"text"},{"text":"SignatureValidation","type":"text","marks":[{"type":"code"}]},{"text":" filter:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A pointer to a certificate file","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A reference to an externally defined TrustEngine bean","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"An inline ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"An inline ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" element","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Filter order is important!","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"In the overall sequence of filters, a filter of type ","type":"text"},{"text":"SignatureValidation","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"must","type":"text","marks":[{"type":"strong"}]},{"text":" appear before any filter that alters the metadata instance. Examples of the latter include ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631645"}},{"text":", ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631646"}},{"text":", ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631650"}},{"text":", and ","type":"text"},{"type":"inlineCard","attrs":{"url":"https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631651"}},{"text":" .","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"XML Attributes"},"content":[{"type":"table","attrs":{"layout":"default","localId":"35ce297c-c1c4-44e3-a495-1324637aa51c"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"Name / Type / Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"requireSignedRoot","type":"text"}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]},{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"If true, this fails to load metadata with no signature on the root XML element.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"alwaysVerifyTrustedSource","type":"text"}]},{"type":"paragraph","content":[{"text":"Boolean","type":"text"}]},{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"If true, the root signature of the metadata currently being processed will always be verified.","type":"text"}]},{"type":"paragraph","content":[{"text":"If false, then the root signature will be verified unless the metadata source is \"trusted\", defined as:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The backup file of a ","type":"text"},{"text":"FileBackedHTTPMetadataProvider","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"certificateFile","type":"text"}]},{"type":"paragraph","content":[{"text":"File pathname","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"Path to a certificate file whose key is used to verify the signature.","type":"text"}]},{"type":"paragraph","content":[{"text":"Conflicts with ","type":"text"},{"text":"trustEngineRef","type":"text","marks":[{"type":"code"}]},{"text":" and both allowable child elements.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"trustEngineRef","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of a ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" defined somewhere else in the configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"Conflicts with ","type":"text"},{"text":"certificateFile","type":"text","marks":[{"type":"code"}]},{"text":" and both allowable child elements.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"defaultCriteriaRef","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]},{"type":"paragraph","content":[{"text":"shibboleth.MetadataSignatureValidationStaticCriteria","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"(ADVANCED, not generally needed)","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID of an externally defined ","type":"text"},{"text":"CriteriaSet","type":"text","marks":[{"type":"link","attrs":{"href":"https://build.shibboleth.net/jenkins/job/java-support-nightly/javadoc/net/shibboleth/utilities/java/support/resolver/CriteriaSet.html"}}]},{"text":" used as input the to the trust engine","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"signaturePrevalidatorRef","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]},{"type":"paragraph","content":[{"text":"SAMLSignatureProfileValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.security.impl.SAMLSignatureProfileValidator"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"(ADVANCED, not generally needed)","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID of an externally defined ","type":"text"},{"text":"SignaturePrevalidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.xmlsec.signature.support.SignaturePrevalidator"}}]},{"text":". Used to perform pre-validation of an XML Signature, for example to validate that the signature conforms to a particular profile of XML Signature.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"dynamicTrustedNamesStrategyRef","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID","type":"text"}]},{"type":"paragraph","content":[{"text":"BasicDynamicTrustedNamesStrategy","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.metadata.resolver.filter.impl.BasicDynamicTrustedNamesStrategy"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"(ADVANCED, not generally needed)","type":"text"}]},{"type":"paragraph","content":[{"text":"Bean ID of an externally defined Function>. This will be used to extract dynamic trusted names from signed metadata elements.","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"XML Elements"},"content":[{"type":"paragraph","content":[{"text":"One of the following two child elements may be configured. Their use conflicts with the ","type":"text"},{"text":"certificateFile","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"trustEngineRef","type":"text","marks":[{"type":"code"}]},{"text":" XML attributes.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"bfb65659-47a5-4473-9f53-ffb857fffc14"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"A PEM-format public key.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can obtain a public key from a certificate using a command such as:","type":"text"}]},{"type":"paragraph","content":[{"text":"$ openssl x509 -pubkey -in cert.pem -noout","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[778.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[774.0]},"content":[{"type":"paragraph","content":[{"text":"A trust engine plugin that defines how the signature is to be checked","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Examples","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Externally specified certificate file","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Inline key","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n MIIBI.....\n \n\n","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Metadata Provider with inline trust engine","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n ${idp.home}/credentials/signer.pem\n \n \n","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Metadata Provider with inline trust engine with multiple validation credentials","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n ${idp.home}/credentials/signer1.pem\n \n \n ${idp.home}/credentials/signer2.pem\n \n \n","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"PKIX signature validation with static trust anchors","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n shib\n \n ${idp.home}/credentials/vtmwca.pem\n \n \n","type":"text"}]}],"version":1}