Metadata Generation

[Cantor, Scott]

On 9/25/14, 7:50 AM, "Tom Scavo" <trscavo at gmail.com> wrote:

>On Thu, Sep 25, 2014 at 6:17 AM, Rod Widdowson <rdw at steadingsoftware.com>
>wrote:
>>
>> Now that we have separate certificates for
>> signing and for the back-channel
>
>You do? Hmm, what's the rationale for that?

Heartbleed. It's clear that the risk of exposure for a TLS key is much
higher, which means the chance of it needing to change is higher. Using
separate keys means you only have to coordinate on that change with a much
smaller set of vendors that might be using SOAP, and that's often zero or
close to it. The majority using it will be Shibboleth SPs, and those you
can automate the change with.

>>but only the back channel one for the
>> <AttributeAuthorityDescriptor>?
>
>Don't you support signing on the back channel? Not sure anyone uses it
>but...

Yes. There's a longstanding argument over it, and Kaspar has been begging
us for years to turn on signing by default for both products. We still
need to discuss whether we're going to, but yes, we still want both keys
just in case.

>>Is it worthwhile adding an encryption key in as well (even though we
>>don't
>> use or configure it).  I would have through not (plus this needs more
>> installation mechanism)
>
>If you don't support it, what's the point?

We do support it, for the NameID in the LogoutRequest message or in the
Subject in an AuthnRequest.

-- Scott