Verify the SP metadata signature

[italia]

Verify the SP metadata signature

[peppelinux]

Actually I adopt the same, or quite similar, approach already adopted by @psmiraglia

spid-sp-test/src/spid_sp_test/metadata.py

Line 204 in b4fc2b5

'EntityDescriptor',

and, according to xmlsec1 docs it's a valid approach.

The resulting xmlsec1 command is

spid_sp_test --metadata-url https://localhost:8000/spid/metadata --extra  --authn-url https://localhost:8000/spid/login/?idp=http://localhost:8080 --debug ERROR -tr


> ~/DEV/DTD/Spid/spid-sp-test/src/spid_sp_test/metadata.py(208)test_xmldsig()
-> is_valid = True
(Pdb) cmd

'xmlsec1 --verify --insecure --id-attr:ID urn:oasis:names:tc:SAML:2.0:metadata:EntityDescriptor /tmp/tmplrqdfscl'