IdP request signing certificate will change

[Jan Keirse]

Hello,

one of the SP's that relies on our IdP reported that they will be changing
the certificate they use to sign their requests on march 2nd.
Their current certificate is defined in a filesystemmetadataprovider xml
file.

The  filesystemmetadataprovider  contains the following:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
entityID="someid">
 <md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 <md:Extensions>
<DiscoveryResponse
xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
Location="someurl" index="1"/>
 </md:Extensions>
<md:KeyDescriptor use="signing">
 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
 ...
</ds:KeyInfo>
 </md:KeyDescriptor>
<md:KeyDescriptor use="encryption">
 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
 ...
</ds:KeyInfo>
 </md:KeyDescriptor>
<md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="someurlhere"/>
<md:ManageNameIDService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="someurlhere"/>
<md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="someurlhere" index="0"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

I've been searching google but can't seem to find a clear unambiguous an
answer to the following question:
Now my question is: Can I just add another block like
<md:KeyDescriptor use="signing">
 <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
 ...
</ds:KeyInfo>
 </md:KeyDescriptor>
with the new certificate today?
Or should I wait till march 2nd and then replace the old certificate with
the new one? Or is there even something else I should do?
>From what I've read in the wiki and on the switch site it appears there's
some method in SAML2 to allow 2 certificates to exist at the same time
during rollover but I'm not certain these should/can exist in both the SP
and the IdP or not.


Kind Regards,

*JAN KEIRSE*
*CORPORATE SERVICES* • *Software Engineer*

-- 
DISCLAIMER ****

http://www.tvh.com/newen2/emaildisclaimer/default.html 

"This message is delivered to all addressees subject to the conditions
set forth in the attached disclaimer, which is an integral part of this
message."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120209/191c4476/attachment.html