How to use the KeyInfo->KeyName instead of KeyInfo->X509Data?

[Cantor, Scott]

On 12/29/11 11:22 AM, "Jason Holland" <jholland at olp.net> wrote:
>
>The SP's documentation says that I need to provide a KeyName instead of
>explicit X509 data in the IdP's responses. What they instruct is to copy
>and paste the cert data into their application and then give it a name,
>then I am supposed to use that same name in the KeyInfo->KeyName field.

If you mean in the assertion:

a) you have no control over that to my knowledge
b) the SP is basically broken; KeyInfo is a hint only and it isn't
required in general to contain anything specific, particularly in a
signature

If you mean in metadata, that's a different story, but I doubt that's what
you mean. An SP that's that broken isn't likely to even use metadata.

>Here is the edited version of the SP's example SAML response showing the
>KeyInfo->KeyName setup:

If the IdP doesn't already inject a KeyName into its signatures, nothing
you do short of hacking code will fix it I suspect.

-- Scott