Fixes #249 Make cert_text a first class anchor

[timlegge]

cert_text with XML::Sig (which needs a documentation update) ignores any X509 data in the XML and "pins" the verification certificate to the certificate passed in cert_text.

both cacert and cert_text can be used but cert_text is more secure since it does not trust a signature signed a different certificate issued by the same CA as the trusted certificate.

[waterkip]

lgtm

[MartijnVdS]

OASIS SAML V2.0 Metadata Interoperability Profile Version 1.0, section 2.6.1 even says it explicitly:

Subsequent to accepting a metadata instance, a consumer MUST NOT apply additional criteria of any kind on the acceptance, or validity, of the keys found within it or their use at runtime. Specifically, consumers SHALL NOT apply any online or offline techniques including, but not limited to, X.509 path validation or revocation lists, OCSP responders, etc.

[...]

In the case of the former, the key itself is explicitly identified. In the case of the latter, a metadata consumer MUST extract the public key found in the certificate and MUST NOT honor, interpret, or make use of any of the information found in the certificate other than as an aid in identifying the key used (based, for example, on information found at runtime in an XML digital signature's ds:KeyInfo element or the certificate presented by a transport peer).

https://docs.oasis-open.org/security/saml/Post2.0/sstc-metadata-iop.html

[timlegge]

OASIS SAML V2.0 Metadata Interoperability Profile Version 1.0, section 2.6.1 even says it explicitly:

Subsequent to accepting a metadata instance, a consumer MUST NOT apply additional criteria of any kind on the acceptance, or validity, of the keys found within it or their use at runtime. Specifically, consumers SHALL NOT apply any online or offline techniques including, but not limited to, X.509 path validation or revocation lists, OCSP responders, etc.
[...]
In the case of the former, the key itself is explicitly identified. In the case of the latter, a metadata consumer MUST extract the public key found in the certificate and MUST NOT honor, interpret, or make use of any of the information found in the certificate other than as an aid in identifying the key used (based, for example, on information found at runtime in an XML digital signature's ds:KeyInfo element or the certificate presented by a transport peer).

https://docs.oasis-open.org/security/saml/Post2.0/sstc-metadata-iop.html

@MartijnVdS can you give a little more context? I read this as you are agreeing with the PR and my comment above but would like to be sure I am not missing anything.

Also, I will review your PR to see if I missed anything.

[MartijnVdS]

https://docs.oasis-open.org/security/saml/Post2.0/sstc-metadata-iop.html

@MartijnVdS can you give a little more context? I read this as you are agreeing with the PR and my comment above but would like to be sure I am not missing anything.

Also, I will review your PR to see if I missed anything.

Sorry, should have given some more context.

This is what I found while writing my PR, and it confirms that pinning the certificate you get from the (IdP) metadata is the correct way to handle it.