OpenSAML user discussion

["Bryn Ryans" <>]

We have additional mechanisms to ensure that the certificate is trusted
(not based on the trust engine). So validate method is not responsible
for validating the certificate. Thanks for the clarification.


-----Original Message-----
From: Chad La Joie 
[mailto:]
 
Sent: Wednesday, July 01, 2009 10:03 AM
To: 

Subject: Re: [OpenSAML] Should SignatureValidator validate whether a
certificate is expired or active?




 wrote:
> While testing we found that the SignatureValidator.validate method
indicated that a saml a signature was valid using an expired
certificate. Is this appropriate behavior or should the validate method
also validate the certificate?

Thats expected.  The signature is valid.  Whether you trust the 
credential is a different matter.

> Is there some other place that the certificate is validated? We have a
very simple implementation and are not using a trust engine.

However you chose to do it.  The trust engines are what the IdP uses to 
do it.  A super, brain-dead-simple, way to do this would be to just have

a trust set of certs and then do a byte[] comparison.  If the cert that 
signed it is in your trust list then you trust it, if not, you don't.

> Its not a big deal as we've added code to check the validity of the
certificate before validating the signature. I'm just wondering if this
is a bug or by design?

Well, if you think the signature is telling you anything then it is a 
big issue, because it's not.  I could easily gen a cert, intercept a 
message, remove the signature, change the message and sign with me cert.

  If you never check if the cert is trusted you'd never know the
difference

DISCLAIMER:
****************************************************************************
This email message and all attachments transmitted with it are for the sole
use of the intended recipient(s) and may contain confidential and privileged
information. Please DO NOT forward this email outside of the recipient's
Company unless expressly authorized to do so herein. Any unauthorized review,
use, disclosure or distribution is prohibited. If you are not the intended
recipient, please contact the sender by reply email and destroy all copies
of the original message.

Any views expressed in this email message are those of the individual sender
except where the sender specifically states them to be the views of Ventyx.
****************************************************************************