Note: The MDQ beta service retired May 1, 2019. It is replaced with a "preview" (pre-production) MDQ service.
References
https://spaces.at.internet2.edu/display/MDQ/The+Guide
https://spaces.at.internet2.edu/display/MDQ/Per-EntityProduction+Metadatametadata+Servicesigning+Documentationhttps://spaces.at.internet2.edu/display/InCCollaborate/Metadata+Query+Protocolkey
Note
First choice is to use InCommon's Metadata Query (MDQ) service to load and manage SAML metadata for the UC Davis IdP. Use the procedure below only when the SAML SP software is incapable of dynamically consuming metadata from a remote source.
https://spaces.at.internet2.edu/display/perentityMDQ/MDQConfigure+Shibboleth+Clientservice+Softwareprovider
https://wikikantarainitiative.shibbolethgithub.netio/confluence/display/XSTJ2/xmlsectool+V2+Home
Caution: The state of MDQ server behavior is in flux, and downloading metadata from the URL below (step 2) with a browser may not provide usable results. Check that your results are XML and not HTML.
Procedure
...
Procedure
Download a copy of the InCommon MDQ signing certificate. Verify its fingerprint.
Code Block curl -O http://md.incommon.org/certs/inc-md-cert-mdq.pem openssl x509 -sha1 -noout -fingerprint -in inc-md-cert-mdq.pem SHA1 Fingerprint=F8:4E:F8:47:EF:BB:EE:47:86:32:DB:94:17:8A:31:A6:94:73:19:36
Fetch the UC Davis IdP metadata (SAML entity ID
urn:mace:incommon:ucdavis.edu
).Code Block curl --silent --output ucdavis-metadata.xml \ http://mdq-preview.incommon.org/entities/urn%3Amace%3Aincommon%3Aucdavis.edu
Validate the XML signature. Note: several other ways to verify the digital signature on an XML document exist, as well, cf. Google search.
https://wiki.shibboleth.net/confluence/display/XSTJ2/xmlsectool+V2+HomeCode Block title xmlsectool xmlsectool --verifySignature --inFile ucdavis-metadata.xml --certificate incommoninc-md-cert-mdq.pem
https://www.aleksey.com/xmlsec/
Code Block title xmlsec1 xmlsec1 --verify --id-attr:ID urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor \ --pubkey-cert-pem inc-md-cert-mdq.pem ucdavis-metadata.xml