IDP certificate metadata

Edwards, Wendy A wedwards at illinois.edu
Fri Oct 17 14:13:22 EDT 2014 

The IDP v3 creds file contain two .crt files, one for encryption and one for signing.  The IDP v2 credentials file contained a single idp.crt file.

The IDP v2 metadata contains two <ds:X509Certificate> elements, which have identical values for Idp v2, since there’s one x509 cert.   For IDP v3 metadata, do we use both idp-encryption.crt and idp-signing.crt?  If so, in any particular order?  Below is what my file looks like:
------------------
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" entityID="https://shibber.ncsa.illinois.edu/idp/shibboleth">

    <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">illinois.edu</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
MIIDUDCCAjigAwIBAgIVALUWhETrTWbylD+md9DCAyq15i7zMA0GCSqGSIb3DQEB
CwUAMCQxIjAgBgNVBAMTGXNoaWJiZXIubmNzYS5pbGxpbm9pcy5lZHUwHhcNMTQx
MDE3MTUzMjUxWhcNMzQxMDE3MTUzMjUxWjAkMSIwIAYDVQQDExlzaGliYmVyLm5j
c2EuaWxsaW5vaXMuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
nxhq74TqaGmHLdTips82d0oVA9jiPwIpYtRRI62Su/aHqFE0uxp9L4QhgXasBUK9
0B8dpFgccwcTtWjr9FUr3BUynAhjgZ9Or5mhWcqI2k1LkOiYOZy86VtlYFZXXS1g
jAWV1OTI293Cv1+laQBVZOTfz1Z/GrBiiQsjU04akBeBbrbnus3MME8jShtg85UD
K25eLBevHe8QpTCVLiEyYRYeq1wPbmmIVQDJb8il49h5ZWnByt0wJ11LFXGzqfLR
taG5FvHgdiv1VsWuZa3vISly2nJ+6RBc0fcAyx6+BIkfBGxnWjU86LzH0fiCla+V
zDgDdH0FCvy2ggezbl2/awIDAQABo3kwdzBWBgNVHREETzBNghlzaGliYmVyLm5j
c2EuaWxsaW5vaXMuZWR1hjBodHRwczovL3NoaWJiZXIubmNzYS5pbGxpbm9pcy5l
ZHUvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFPxPd5NL6gvnjmjBCQj7iKX9IvsR
MA0GCSqGSIb3DQEBCwUAA4IBAQBV7qrjNpzVyjsQabQdE09LYo2PkX5rP2j3d4Yq
oFb3IMSxtkFc7T9cHfv2KolI4H5qyb+MPUyo1JhBdlipcoK2ommL4pC7SXYiUXvc
hmtKR+jpdphJWiZboZhI+X5e+TXJ11uPu7LLpXJ84/LlfFLQQU0Ok3/nHbEdhZO6
w75B+tgVlrmcuIo3YQNpJRIDSqVchzVDNOtr4mg3uQXkjN4hhOrYAsb4Fq2ox+aH
vhEuIIf3MCmo9pRc9nSmvFRQGVEbtCuk6Cj+6SQQ4/x1XqDfN1cB6vo/3B2WpWpr
Q2nph8zKq/bot9DNUbGDl2NxoEzKR3Z/1rQRUrCeTBVCXbbt

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://shibber.ncsa.illinois.edu:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>

        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://shibber.ncsa.illinois.edu:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>

        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://shibber.ncsa.illinois.edu/idp/profile/SAML2/Redirect/SLO" />

        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibber.ncsa.illinois.edu/idp/profile/SAML2/POST/SLO" />

        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://shibber.ncsa.illinois.edu:8443/idp/profile/SAML2/SOAP/SLO" />

        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

        <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://shibber.ncsa.illinois.edu/idp/profile/Shibboleth/SSO"/>

        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://shibber.ncsa.illinois.edu/idp/profile/SAML2/POST/SSO"/>

        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://shibber.ncsa.illinois.edu/idp/profile/SAML2/POST-SimpleSign/SSO"/>

        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://shibber.ncsa.illinois.edu/idp/profile/SAML2/Redirect/SSO"/>
    </IDPSSODescriptor>

    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">illinois.edu</shibmd:Scope>
        </Extensions>

        <KeyDescriptor>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>
MIIDUDCCAjigAwIBAgIVAIt2VF1d8m1AgejePPQjnPmy6ThNMA0GCSqGSIb3DQEB
CwUAMCQxIjAgBgNVBAMTGXNoaWJiZXIubmNzYS5pbGxpbm9pcy5lZHUwHhcNMTQx
MDE3MTUzMjQ5WhcNMzQxMDE3MTUzMjQ5WjAkMSIwIAYDVQQDExlzaGliYmVyLm5j
c2EuaWxsaW5vaXMuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
334UxquMLhTotWPMm4xLMWrDTnFDe51cKXXlGVRaacwyMRbPB0w7Lhn3+6OGBdrx
i/aQFA9iSwX0uwfUfijpRcVP1b35dw64djLRF98kecsH9H2UMI81b/crMHpFD+HY
7i2kjhL/Ya/zMBP0dHxnGFfChYyrF8O08DNvAz3nRKZGI/lHitCBf5PUrJzXaDqB
Fz7PnJ0gJOmV9lZkTDaHHrdqCDlgOtLY2f+YTIYZzqc2oO+SQUiYcjMeLZ/Gf8C/
5CB0bFcBQxPKxWvg2dDTOW7QjRr0/WyNu70OUMRBekdbGVLrtSpx0l3UcU8d+YUl
YLiWGd3Wbpe12bDRUl+74QIDAQABo3kwdzBWBgNVHREETzBNghlzaGliYmVyLm5j
c2EuaWxsaW5vaXMuZWR1hjBodHRwczovL3NoaWJiZXIubmNzYS5pbGxpbm9pcy5l
ZHUvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFEKJ8SmuZL6porHCwkJ8CCfxgJ60
MA0GCSqGSIb3DQEBCwUAA4IBAQCNvmsf2B3fvyaO0bnUy+ibUQsquHGjlQMlhPPY
OkJMSpmDiILkhAIZgN7RMVQy8Dh9gRil8gpmyuy8DInjiBqSN5mv0V5ZH5KssKwf
/CcGZF7SO828A6XMJOTeDVY721G0t8m4D1Q5+DqWGToiQ5PLRYmCghoKNp4osnA1
BlS9bvggEuUHRfglhXABMjrS0oHNh1hGAqZXC3KZcybw1q2AT2FYD9zG/V/2XXgK
swRj7tYVqTcvyvQZNDFaDaXOcyFPCcyGfrFd3DIFZkkWjMRu0zrOOev+WcR9MqOy
FfcE2n1jVmOJORKBixl5rJd4q8tcNt1lEVpvaEqZsSVexJIw

                    </ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>

        <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://shibber.ncsa.illinois.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>

        <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://shibber.ncsa.illinois.edu:8443/idp/profile/SAML2/SOAP/AttributeQuery"/>

        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>

    </AttributeAuthorityDescriptor>

</EntityDescriptor>



--------------------
Thanks,
Wendy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20141017/7cdd3188/attachment.html

More information about the dev mailing list