Shibboleth IDP signing and encryption keys protected by a password

[Ignacio Cañón Sánchez]

Hi Scott,
about the signed certificates, I'm working with Guillermo in the same
project, obviously we agree with your opinion about password stored in some
file, but in our case is our customer who wants to know if this feaure is
available, because is a kind of general security requirement in the company.
Could you give us more light about how could we achieve this?
Thanks in advance

2016-03-14 17:03 GMT+01:00 Cantor, Scott <cantor.2 at osu.edu>:

> > Is there any way to generate and use idp-signing.key and
> idp-encryption.key
> > files protected by a password?
>
> Keys that aren't in keystores can be generated with openssl and encrypted
> with a password in the normal way. I don't believe that I included any such
> feature in the Java class used by the installer. I assume, but don't really
> know, that the classes that load the keys have the ability to have a
> password set in the Spring config, both old and new.
>
> My general view is that protecting things with passwords that have to be
> stored in a configuration file is stupid. If you're one of the rare folks
> actually willing to forego unattended restart of the system, you are exempt
> from that conclusion, but that's why it doesn't default to that.
>
> The keystores that are passworded are so because Java doesn't give us a
> choice.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>



-- 

Ignacio Cañón Sánchez

[image: logo Paradigma.png]

------------------------------------------------------------

http://www.paradigmadigital.com

Vía de las Dos Castillas 33, Ática 4. 2ª Planta

28224 Pozuelo de Alarcón

Tel.: 91 352 59 42 // @paradigmate
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160315/947b2813/attachment.html>