Shibboleth SP V3 Beta available for Windows

[David Langenberg]

Yeah, PLEASE do not make installers go off and generate the keys manually as
part of configuration.  Getting folks to be comfortable with editing the
.xml config file to set an entityID, especially on windows, is hard enough
already. I really don't want the added burden of trying to explain to them
how to run the script to make the keys and from there how to know if they
did it right.  

Never ask a user to do something that the computer should be able to figure
out and do on it's own definitely applies.

Dave

--
David Langenberg
Asst Director, Identity Management
The University of Chicago

-----Original Message-----
From: dev <dev-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, June 4, 2018 2:40 PM
To: Shib Dev <dev at shibboleth.net>
Subject: RE: Shibboleth SP V3 Beta available for Windows

> Have you decided on the names for the auto-generated key pairs?

Well, I picked names, it's not set in stone though it's a little bit of a
pain to change them so I would rather get them re-decided once and then
change them if I have to. Currently new installs get sp-signing-cert/key.pem
and sp-encrypt-cert/key.pem, and upgrades of course are untouched.

> If 'sp-cert.pem' and 'sp-key.pem' remain the defaults for the 
> encryption key then people following documentation that has not been 
> updated yet (or that will never be updated...) will still "find" the
correct cert for the metadata.

I think that's going to be confusing, personally. I don't care that much
what the names are, but neither should be what they are now.

> Another approach might be to not auto-generate the signing keys but 
> instead provide and document a simple "wrapper" (around OpenSSL) 
> script to generate the signing keys if/when necessary.

I didn't see much value in making people jump through hoops to get them
generated, but the wrapper is already there. If people really think it
should "just generate" an encryption key, I could do that, but I am
definitely against naming it generically. I would agree that if I was to
leave *either* name alone, it would be the encryption key, but I don't think
that's a good idea.

-- Scott

--
To unsubscribe from this list send an email to
dev-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5694 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20180605/7dec83c1/attachment.p7s>