Page History

...

1. Check the exp Claim: First, verify the exp (Expiration Time) claim in the JWS payload. Ensure that the current timestamp is before the specified expiration time. If the data is past its expiration time, it should not be considered valid.

2. Validate the Digital Signature: To verify the authenticity of the metadata, use the alg (Algorithm) and x5t#S256 header claims in the JWS header.

   • alg Claim: Ensure that the algorithm specified in the alg claim matches the one used for signing (e.g., "ES256" for ECDSA with P-256 and SHA-256).

   • x5t#S256 Claim: This  This claim specifies the SHA-256 thumbprint of the X.509 certificate that corresponds to the signing key used for creating the JWS. It should correspond to To ensure trust and authenticity in the metadata exchange process, it is imperative that this thumbprint matches the thumbprint of the certificate used for signing in X.509 certificate contained within the SAML metadata.

     • Retrieve the Certificate: Begin by extracting the X.509 certificate from the SAML metadata. This certificate is found within the <ds:X509Certificate> element, which resides inside the <grie:GroupRepresentative> element.

     • Calculate the Thumbprint: Calculate the thumbprint of the retrieved X.509 certificate , and calculate its SHA-256 thumbprint (see Understanding the x5t#S256 Header Claim).

     • Comparison: Compare the calculated thumbprint with the value of the x5t#S256 claim in the JWS header. If they these thumbprints do not match, it indicates a potential security issue, and the metadata should not be trusted.

3. Check the Issuer (iss) Claim: Verify that the iss (Issuer) claim in the JWS payload matches the expected issuer URI. This ensures that the metadata is coming from a trusted source.

4. Validate the iat Claim: Ensure that the iat (Issued At) claim is a valid NumericDate representing the time when the data was issued.

...