Saml: Is it necessary to trust and verify public key for ssl when the artifact response is signed? -
i've made implementation based on filesystemmetadataprovider: https://github.com/vdenotaris/spring-boot-security-saml-sample
to make ssl handshake artifact binding work put ssl sertificates endpoint in idps metafile(i tried put both leaf , ca in cacerts on jre , trust store of server didn't work).
i don't want maintenance generating certificates , modifing idps metafile when leaf certificate changes.
is necessary mess transport layer? isn't enough check ssl certificate valid , after check signature of assertion?
i asked idp. few choose trust ssl certificate , should enough validate ssl certificate , check signature in assertion.
Comments
Post a Comment