An open discussion list for topics related to the eduGAIN interfederation service.

[Peter Schober <peter.schober AT univie.ac.at>]

* Zenon Mousmoulas <zmousm AT noc.grnet.gr> [2019-09-18 08:09]:
> I suppose this signature should have been stripped at some point.

* All signatures need be able to be verified by all metadata consumers.
  So if that signature is NOT by the federation operator (but by an
  entity owner) this signature must be removed by the federation
  operator before publishing.

* There's no upside to signing individual EntityDescriptors within a
  signed EntitiesDescriptor element when publishing aggregates, so if
  the signature is by the federation operator it should still be
  removed there.

So yes, it should be removed in either case.

The pyff distribution comes with an XSLT snippet that does just that:
https://github.com/IdentityPython/pyFF/blob/master/src/pyff/xslt/unsign.xsl
but that would have to be applied by RoEduNet before publishing (or
even registering that metadata within their systems/federation).

-peter