Shibboleth Developers

["Scott Cantor" <>]

> Yes, but that brings up a point.  Our production installation won't
> verify the metadata.  The tool always says "signature did not
> verify".  Our development idp also 1.3, but version 1.3c, does
> verify the signatures OK.

That's a symptom of a bug in an opensaml build caused by the switch to
Xerces to fix the memory leaks that was accidentally left out of 1.3b but
released in 1.3c.

You can fix it by updating the opensaml jar in your <install>/lib folder
without disrupting your IdP itself.

> If the production system signs a file it can then verify it -
> and the dev system can verify it also.  However, if the dev system
> signs a file the production system cannot verify it.

That's moderately surprising. I wouldn't expect it to verify anything that
included base64 blobs inside the signed content.

-- Scott