Uploaded image for project: 'Shibboleth SP - C++'
  1. Shibboleth SP - C++
  2. SSPCPP-684

Successfully cached metadata documents containing `
` subquently fail signature validation

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.5.6
    • Fix Version/s: 2.6.0
    • Component/s: Other
    • Environment:
    • Operating System:
      Multiple
    • CPU Type:
      Multiple
    • C/C++ Compiler:
      Multiple
    • Web Server:
      Multiple

      Description

      Discussion of this issue is available at http://marc.info/?l=shibboleth-users&m=145853734225037

      Metadata documents which contain ` ` are loaded and verified by shibd without problem on initial request from upstream.

      If shibd subsequently attempts to read the locally cached metadata document it cannot verify the signature and the service begins to fail.

      The current theory is that unexpected normalization is occurring when shibd is writing out the cached metadata document hence the subsequent invalid signature state occuring.

      We've seen this happen within the AAF and it has also happened recently with an entity that was entered via eduGAIN. This seems to impact 'free text' descriptive fields in particular with my thought being the cause is copy/paste from Word documents (or similar on Windows) for these fields.

      As a work around the AAF is now filtering out all instances of ` ` from metadata documents prior to signing. This has no impact on our metadata XML and ensures shibd continues to function.

        Attachments

          Activity

            People

            Assignee:
            rdw@iay.org.uk Rod Widdowson
            Reporter:
            bradleybeddoes@vho.aaf.edu.au Bradley Beddoes
            Watchers:
            6 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0 minutes
                0m
                Logged:
                Time Spent - 2 days, 45 minutes
                2d 45m