Questions about signing key pair in IdP

[Cantor, Scott]

> As I understand from the above article, the key pair for signing and the
> key pair for the SSL/TLS on port 8443 MUST always be the same and this
> single public key is published through <md:KeyDescriptor use="signing">
> in metadata, right?

No, not at all. The keys are what you want them to be. The only requirement is to document them in the metadata you provide to SPs.

> But from a plain technical view (or by wrong configuration) the key
> pairs could be different and I try to figure out what would break:

Nothing, unless you fail to put the key into the metadata.

> If the metadata KeyDescriptor does not match the SSL/TLS credentials,
> the SP refuses communication to IdP on 8443 at all?

Yes, but that doesn't mean they have to be the same.

> And one more question about key pairs and TrustManagement:
> with <TrustEngine type="ExplicitKey"/> in the SP, there is none of the
> PKI mechanism like validation of RootCA/revocation lists/certificate CN
> or subjectAltName involved for both SSL/TLS on 8443 and SAML signing. So
> only the existence of <md:KeyDescriptor use="signing"> in metadata is
> sufficient for trust from SP side, right?

https://wiki.shibboleth.net/confluence/display/SHIB2/TrustManagement

-- Scott