Exception when creating the signature using OpenSAML lib

[Brent Putman]

On 11/1/12 5:28 PM, Yaowen Tu wrote:
>
>
> For the key, I think I understand it, but I may need some
> clarification. My opinion is metadata is used to provide some
> information to consumer including SAML keys. 

Yes.

> How we can trust the metadata is to verify the signature. We need to
> use some key to verify the signature. Then the question result into:
> how do we trust the key used for signature. As you said, we can use
> PKIX to verify the certificate and the key, or we can find some secure
> channel to distribute the key. As soon as we trust the key used for
> signature, we are done. 

Yes.


> It really doesn't matter what key we would use for SAML operations. 

No, it doesn't matter, as long as the key is present  within a
KeyDescriptor under the correct role and protocol in the metadata and
with the correct usage specifier.


> We implicitly trust the SAML key because we already verified signature
> and trusted metadata, so we trust everything in the metadata including
> SAML key.

Yes.  Note that signed SAML metadata containing keys is essentially
another form of public key "infrastructure" (without all the actual
infrastructure), in that it is cryptographically binding one or more
keys to an entity's identifier and other info about the entity.  Which
is exactly what an X.509 certificate does.



> So my point is that there is no technical reason why we cannot use the
> same key for signature and SAML operations. My I correct?

As I said earlier, there is no technical reason you can't do this.  You
just have to decide on a trust model for the metadata signing key.