How to use the KeyInfo->KeyName instead of KeyInfo->X509Data?

Jason Holland jholland at olp.net
Thu Dec 29 16:22:03 GMT 2011


In my quest for world domination using Shibboleth as my IdP I have found
myself facing one more hurdle to jump in order integrate an SP with
limited SAML support. 

The SP's documentation says that I need to provide a KeyName instead of
explicit X509 data in the IdP's responses. What they instruct is to copy
and paste the cert data into their application and then give it a name,
then I am supposed to use that same name in the KeyInfo->KeyName field.
I Googled and searched the Shibboleth docs on using the KeyName but I
don't know what is the correct documentation to follow, could someone
point me in the right direction on how to do this by providing a link to
the correct documentation?

Here is the edited version of the SP's example SAML response showing the
KeyInfo->KeyName setup:
<samlp:Response ...>
   ...
  <saml:Assertion ...>
    ...
    <ds:Signature ...>
      ...
      <ds:KeyInfo>
        <ds:KeyName>samlkey</ds:KeyName>
      </ds:KeyName>
    </ds:Signature>
    ...
  </saml:Assertion>
</samlp:Response>

Thanks,
Jason


More information about the users mailing list