References
https://spaces.internet2.edu/display/InCFederation/Metadata+Query+Protocol
https://spaces.internet2.edu/display/perentity/MDQ+Client+Software
https://spaces.internet2.edu/display/InCCollaborate/Metadata+Query+Server
https://wiki.shibboleth.net/confluence/display/XSTJ2/xmlsectool+V2+Home
Procedure
Obtain the InCommon Metadata Query Protocol signing certificate. Though this service is currently beta, the data is production.
curl -OL https://ds.incommon.org/certs/mdq-beta-cert.pem
- Verify the certificate's signing key fingerprint with information on this page
https://ops.incommon.org/mdq_beta_cert.html
/usr/bin/openssl x509 -sha256 -noout -fingerprint -in mdq-beta-cert.pem
Fetch our IdP metadata.
curl --silent --output ucdavis-metadata.xml \ http://mdq-beta.incommon.org/global/entities/urn%3Amace%3Aincommon%3Aucdavis.edu
Validate the XML signature.
xmlsectool --verifySignature --inFile ucdavis-metadata.xml --certificate mdq-beta-cert.pem