InCommon metadata support

[Nick Roy <>]

On 7/20/18 2:20 PM, Cantor, Scott wrote:
> I wonder if there's some creative trick one could use whereby periodically 
> a test would be run that served up an invalid signed metadata instance 
> containing something that would be externally noticeable as having been 
> accepted.
> 
> Nasty trick, and hard to do with a production system since anything 
> externally observable would likely break actual use, but it's an 
> interesting idea. Certainly it's possible if you consider a federated app, 
> where the "broken" IdP case wouldn't be a real IdP, but for siloed apps, 
> it's much harder.

Interesting idea, but unfortunately it would break the systems that are
doing the right thing, rather than breaking those that aren't, and might
be an incentive to people to not verify the signature. Like you said, it
would have to be non-production.

I am in the early stages of scoping out a test federation, and we plan
to do stuff like rotate keys on the metadata and in the test fixture
SAML deployments to try to make sure people are checking the signature
and also handling IdP/SP key rollover scenarios there.

Best,

Nick

> 
> But given that almost no siloed app does verify a signature, and likely 
> they never will, maybe that's an interesting requirement to add to a future 
> R&S spec and focus on those cases.
> 
> Of course, IdPs would also be subject to this.
> 
> -- Scott
> 
> 
>