WS-Federation resource provider relationship with our IdP

[Peter Williams]

Commercial products will hopefully use an evaluated OS and its features for key management.

In Windows, there is a significant barrier to doing "better grade" key management. You typically need a certified engineer (and not one, like me, who from a American firm, got all the answers to cisco and windows certification tests given to him ...alongside all the DoD personnel and Whitehouse IT support staff getting their "formalities" in order...).

Its hard to do key management right, commercially. For every dollar spent, 10 are spent by NSA defeating it or the staff operating the systems. Its hard to know how to invest in such a trust culture, where the subversion comes from within the social structures.

I know when I started this websso thing (in the idealism days), I worked hard to make the Ping Federate server use its HSM, with clustered nodes and full key management cloning, etc. While it did work, the firm just looked at him as daft (hinting that it was only there for procurement test passing, and not that ANYONE used it).

From: Cantor, Scott<mailto:cantor.2 at osu.edu>
Sent: ?Friday?, ?March? ?28?, ?2014 ?12?:?22? ?PM
To: Shib Dev<mailto:dev at shibboleth.net>

On 3/28/14, 2:43 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>And speaking of metadata issues, AD FS has its share of those. It's
>unlikely their AD FS SP will be able to directly consume any metadata
>file you provide (maybe FEMMA will work, I don't know), which means
>you're trapped when it comes time to migrate a certificate in IdP
>metadata, or something along those lines.

I took the OP's description to mean they'd likely be supplying their own
metadata, and basic SAML metadata, even from a Shibboleth IdP or SP pretty
much works fine.

As far as migrating a key, sure, but that doesn't work with any commercial
products, so ADFS is no worse. And obviously using a non-SAML protocol
won't improve matters in any of these respects.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140328/0330e9f4/attachment.html